{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acampcodesonline_learning_management_system1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:campcodes:online_learning_management_system:1.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2025-11077"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Online Learning Management System (1.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Campcodes"],"content_html":"\u003cp\u003eCVE-2025-11077 is a critical blind SQL injection vulnerability affecting Campcodes Online Learning Management System version 1.0. The vulnerability resides in the 'add_content.php' script and is reachable via a POST request to the 'Title' parameter. An unauthenticated attacker can leverage this flaw to perform time-based SQL injection, potentially leading to unauthorized data exfiltration from the underlying database. A functional proof-of-concept exploit is publicly available.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthenticated, remote blind SQL injection, which can lead to complete database compromise and information disclosure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of Campcodes Online Learning Management System 1.0 within your environment and restrict network access to these assets.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST requests to '/admin/add_content.php' that contain SQL syntax, time-delay functions (e.g., SLEEP, BENCHMARK), or unusual character patterns.\u003c/li\u003e\n\u003cli\u003eImplement Web Application Firewall (WAF) rules to inspect and sanitize the 'Title' parameter in POST requests directed at 'add_content.php'.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T14:27:15Z","date_published":"2026-11-09T14:27:15Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2025-11077/","summary":"CVE-2025-11077 is a critical blind SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allowing remote, unauthenticated database exfiltration via the Title parameter in add_content.php.","title":"Campcodes Online Learning Management System: Blind SQL Injection (CVE-2025-11077)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2025-11077/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:campcodes:online_learning_management_system:1.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}