Campcodes Online Learning Management System: Blind SQL Injection (CVE-2025-11077)

CVE-2025-11077 is a critical blind SQL injection vulnerability affecting Campcodes Online Learning Management System version 1.0. The vulnerability resides in the 'add_content.php' script and is reachable via a POST request to the 'Title' parameter. An unauthenticated attacker can leverage this flaw to perform time-based SQL injection, potentially leading to unauthorized data exfiltration from the underlying database. A functional proof-of-concept exploit is publicly available.

Impact

Successful exploitation allows for unauthenticated, remote blind SQL injection, which can lead to complete database compromise and information disclosure.

Recommendation

• Identify all instances of Campcodes Online Learning Management System 1.0 within your environment and restrict network access to these assets.
• Monitor web server access logs for anomalous POST requests to '/admin/add_content.php' that contain SQL syntax, time-delay functions (e.g., SLEEP, BENCHMARK), or unusual character patterns.
• Implement Web Application Firewall (WAF) rules to inspect and sanitize the 'Title' parameter in POST requests directed at 'add_content.php'.