CVE-2025-10781 in Online Learning Management System
Summary
by MITRE • 09/22/2025
A vulnerability was identified in Campcodes Online Learning Management System 1.0. This impacts an unknown function of the file /admin/edit_class.php. Such manipulation of the argument class_name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/13/2026
The vulnerability discovered in Campcodes Online Learning Management System version 1.0 represents a critical security flaw that undermines the integrity of the application's database operations. This issue manifests within the administrative interface through the /admin/edit_class.php file, where improper input validation creates an avenue for malicious actors to manipulate database queries. The specific vulnerability stems from the class_name parameter which is directly incorporated into SQL statements without adequate sanitization or parameterization, creating a classic sql injection vulnerability that can be exploited by attackers with minimal technical expertise.
The technical implementation of this vulnerability falls under the Common Weakness Enumeration category CWE-89, which specifically addresses SQL injection flaws where untrusted data is incorporated into database queries without proper validation or escaping mechanisms. The attack vector is particularly dangerous as it operates through remote execution capabilities, meaning that an attacker does not require physical access to the system or local network privileges to exploit the flaw. The publicly available exploit further amplifies the risk profile, as it eliminates the need for custom development and allows any malicious actor to leverage this weakness against vulnerable installations. This remote code execution capability through sql injection enables attackers to manipulate, retrieve, modify, or delete sensitive data from the underlying database.
The operational impact of this vulnerability extends beyond simple data compromise to encompass complete system compromise and potential data breaches. Attackers can leverage this vulnerability to extract confidential user information, including student records, administrative credentials, and course materials that may contain sensitive educational data. The implications are particularly severe for educational institutions that rely on such platforms for managing student information, as the breach could expose personal details, academic records, and potentially academic integrity data. Additionally, the vulnerability could enable attackers to escalate privileges within the system, potentially gaining administrative control over the entire learning management platform and its associated resources.
Mitigation strategies should prioritize immediate patching of the vulnerable application to address the sql injection flaw in the edit_class.php file. Organizations should implement proper input validation and parameterized queries to prevent direct incorporation of user-supplied data into database operations. The principle of least privilege should be enforced by ensuring that database accounts used by the application have minimal required permissions and that access controls are properly configured. Network segmentation and intrusion detection systems can help monitor for exploitation attempts, while regular security assessments and vulnerability scanning should be conducted to identify similar flaws in other components of the system. Organizations should also consider implementing web application firewalls to detect and block malicious sql injection attempts, and establish incident response procedures to address potential exploitation of this vulnerability. The ATT&CK framework categorizes this type of vulnerability under T1190 - Exploit Public-Facing Application, highlighting the importance of securing externally accessible web applications and the need for continuous monitoring of publicly exposed systems.