PT-2025-35496 · Unknown · Campcodes Online Learning Management System

Wyx_02 · Published 2025-09-01 · Updated 2025-09-03 · CVE-2025-9786

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Campcodes Online Learning Management System version 1.0

Description A SQL injection issue exists in Campcodes Online Learning Management System version 1.0. The issue is located in the /teacher signup.php file, within an unknown function. Manipulation of the firstname argument can trigger the SQL injection. The attack can be initiated remotely, and the exploit has been made public. Other parameters might also be affected.

Recommendations As a temporary workaround, consider restricting or disabling the use of the /teacher signup.php file until a fix is available. Sanitize the firstname parameter before using it in any database queries.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-9786

Affected Products

Campcodes Online Learning Management System

References · 11

• 🔥 https://github.com/wyyyxxxx1017/CVE/issues/6 · Exploit
• https://osv.dev/vulnerability/CVE-2025-9786 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9786 · Security Note
• https://vuldb.com/?submit.640996 · Note
• https://t.me/cveNotify/134187 · Telegram Post
• https://t.me/CVEtracker/31445 · Telegram Post
• https://vuldb.com/?ctiid.322102 · Note
• https://campcodes.com · Note
• https://vuldb.com/?id.322102 · Note
• https://twitter.com/VulmonFeeds/status/1962570678017597613 · Twitter Post
• https://twitter.com/CVEnew/status/1962543581484240946 · Twitter Post