CVE-2025-10782
📋 TL;DR
Campcodes Online Learning Management System 1.0 contains a SQL injection vulnerability in the /admin/class.php file via the class_name parameter. This allows remote attackers to execute arbitrary SQL commands on the database. All users running version 1.0 are affected.
💻 Affected Systems
- Campcodes Online Learning Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, privilege escalation, and potential system takeover through admin account compromise.
If Mitigated
Limited impact if proper input validation and WAF rules are in place, though SQL injection attempts may still be logged.
🎯 Exploit Status
Exploit code is publicly available on GitHub, making this easily weaponizable by attackers with minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.campcodes.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates. Consider implementing workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement proper input validation and parameterized queries for the class_name parameter in /admin/class.php
Modify PHP code to use prepared statements: $stmt = $conn->prepare('SELECT * FROM classes WHERE class_name = ?'); $stmt->bind_param('s', $class_name);
Web Application Firewall Rules
allDeploy WAF rules to block SQL injection patterns targeting the /admin/class.php endpoint
Add WAF rule: Block requests to /admin/class.php containing SQL keywords like UNION, SELECT, INSERT, UPDATE, DELETE, DROP, OR, AND in class_name parameter
🧯 If You Can't Patch
- Isolate the system behind a reverse proxy with strict input filtering and rate limiting
- Implement network segmentation to limit database access from the web server
🔍 How to Verify
Check if Vulnerable:
Test the /admin/class.php endpoint with SQL injection payloads in the class_name parameter (e.g., class_name=' OR '1'='1)Check Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin panel
- Requests to /admin/class.php with SQL keywords in parameters
Network Indicators:
- Unusual outbound database connections from web server
- Traffic patterns indicating database enumeration
SIEM Query:
source="web_logs" AND uri="/admin/class.php" AND (param="*UNION*" OR param="*SELECT*" OR param="*INSERT*" OR param="*UPDATE*" OR param="*DELETE*")