CVE-2025-11555 identifies a SQL injection vulnerability in Campcodes Online Learning Management System version 1.0, located in the /admin/calendar_of_events.php script. The vulnerability is triggered by manipulation of the date_start parameter, which is not properly sanitized before being used in SQL queries. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to unauthorized data retrieval, modification, or deletion within the backend database. The vulnerability does not require user interaction or privileges, making it easier to exploit remotely. The CVSS 4.0 vector indicates network attack vector (AV:N), low attack complexity (AC:L), no authentication required (AT:N), and no user interaction (UI:N). The impact on confidentiality, integrity, and availability is low to limited but still significant given the potential for data exposure or corruption. The vulnerability affects only version 1.0 of the product, and no official patches or mitigations have been published yet. The exploit code is publicly available, increasing the risk of exploitation by attackers. The vulnerability is currently not known to be exploited in the wild, but the presence of public exploit code necessitates immediate attention.

The SQL injection vulnerability in Campcodes LMS 1.0 can lead to unauthorized access to sensitive data stored in the backend database, including user information, course content, and administrative data. Attackers could manipulate or delete data, disrupting the integrity and availability of the LMS. This could result in data breaches, loss of trust, and operational downtime for educational institutions relying on this platform. Since the vulnerability is remotely exploitable without authentication, it poses a significant risk to any exposed installations. The public availability of exploit code increases the likelihood of attacks, potentially leading to widespread compromise if not mitigated promptly. Organizations may face compliance and reputational damage if sensitive student or staff data is exposed or altered.

Organizations using Campcodes Online Learning Management System version 1.0 should immediately restrict external access to the /admin/calendar_of_events.php endpoint, ideally limiting it to trusted internal networks or VPNs. Employ web application firewalls (WAFs) with custom rules to detect and block SQL injection attempts targeting the date_start parameter. Conduct thorough input validation and sanitization on all parameters, especially date_start, to prevent injection attacks. If possible, upgrade to a newer, patched version of the LMS once available. In the absence of official patches, consider applying virtual patching via WAF or intrusion prevention systems. Regularly monitor logs for suspicious SQL queries or unusual database activity. Educate administrators about the risk and ensure backups are current to enable recovery in case of data compromise. Engage with the vendor for timely updates and patches.