CVE-2025-11077 is a high severity (CVSS 7.3) SQL injection flaw in Campcodes Online Learning Management System version 1.0. The Title parameter of add_content.php reaches a database query unsafely. The record lists no fixed release, so take the app off the public internet, fix the query with prepared statements, or retire the software.
What's affected
The record names Campcodes Online Learning Management System version 1.0. The affected code is /admin/add_content.php, where the Title input is handled unsafely. NVD scores it 7.3 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which means network reachable, low complexity, no privileges and no user interaction.
No fixed version is named in the NVD record or in the references it lists. Do not assume a later download is safe. Check the vendor page for a changelog, and compare the code before you trust it.
Weakness classes: CWE-74, CWE-89. The record says a public write-up exists, which is why this one is worth acting on even though the software is small.
How to check if you're exposed
First find out whether you run this software at all. Search your servers and repositories for the file, then look at how it builds its query.
find / -type f -name 'add_content.php' 2>/dev/null
grep -rn "Title" --include=*.php . | head
If the input goes into a query string by concatenation, the code is exposed. Then check your web server access log for requests to add_content.php from addresses you do not recognise, and for unusual characters in the Title value. Log paths vary by server, so use the one your stack writes to.
You can also run the free in-browser dependency scan at gold.safeguard.sh/scan on any manifest you have. Note that this kind of finding lives in application code, not in a package, so a manual look matters here.
What to do now
- Decide whether you still need this software. Small PHP projects like this often have no active maintainer, so check whether this one does.
- If you keep it, take it off the public internet. Put it behind a VPN or an IP allow list.
- Fix the query. Replace string concatenation with prepared statements, as in the sample below.
- Run the database account with the least rights it needs, so that a bug cannot read or change more than it should.
- Watch the vendor page and the NVD record for a patched release, and read the changelog before you upgrade.
- Review logs for the past weeks for odd requests to
add_content.php.
$stmt = $pdo->prepare('SELECT * FROM items WHERE id = :id');
$stmt->execute([':id' => $_GET['id']]);
$rows = $stmt->fetchAll();
Why it matters
This is a classic injection bug. The code takes a request value and places it straight into a database command, so the database cannot tell data from instructions. CWE-74 is the general injection class, and CWE-89 is the SQL form of it.
Notice that the record is for one file and one parameter. In projects of this style, sibling pages tend to share the pattern, so a single CVE is often the first of several. Plan a review of every query in the project, not just the one named.
Quick check
Is a fixed version of Online Learning Management System available?
The NVD record and its references do not name one. Check the vendor page, and treat any new download as unreviewed until you read the code.
Does a web application firewall fix this?
It can reduce the noise, but it does not repair the query. Use it as a stopgap and still fix the code with prepared statements.
Sources
- NVD record for CVE-2025-11077
- Reference listed in the record
- Reference listed in the record
- Safeguard Gold page for CVE-2025-11077
Last reviewed: 19 October 2026.
