Online Learning Management System (1.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/online-learning-management-system-1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 14:27:15 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCampcodes Online Learning Management System: Blind SQL Injection (CVE-2025-11077)https://feed.craftedsignal.io/briefs/2026-11-cve-2025-11077/Mon, 09 Nov 2026 14:27:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2025-11077/CVE-2025-11077 is a critical blind SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allowing remote, unauthenticated database exfiltration via the Title parameter in add_content.php.CVE-2025-11077 is a critical blind SQL injection vulnerability affecting Campcodes Online Learning Management System version 1.0. The vulnerability resides in the 'add_content.php' script and is reachable via a POST request to the 'Title' parameter. An unauthenticated attacker can leverage this flaw to perform time-based SQL injection, potentially leading to unauthorized data exfiltration from the underlying database. A functional proof-of-concept exploit is publicly available.

Impact

Successful exploitation allows for unauthenticated, remote blind SQL injection, which can lead to complete database compromise and information disclosure.

Recommendation

  • Identify all instances of Campcodes Online Learning Management System 1.0 within your environment and restrict network access to these assets.
  • Monitor web server access logs for anomalous POST requests to '/admin/add_content.php' that contain SQL syntax, time-delay functions (e.g., SLEEP, BENCHMARK), or unusual character patterns.
  • Implement Web Application Firewall (WAF) rules to inspect and sanitize the 'Title' parameter in POST requests directed at 'add_content.php'.
]]>criticaladvisory