CVE-2025-9763 is a high severity SQL injection flaw (CVSS 7.3) in the Campcodes Online Learning Management System, version 1.0. The Username parameter of /student_signup.php reaches a database query without safe handling. I could not confirm a vendor fix, so restrict access, review the code and check the advisory for updates.
What's affected
The record lists Campcodes Online Learning Management System version 1.0 as affected. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which describes a network attack with low complexity that needs no privileges and no user interaction.
Fixed versions: I could not confirm one. The record and the reporter's page I read describe the flaw in the project's published source and do not point to a patched release. Check the vendor's download page and the project listing before assuming a fix exists.
How to check if you're exposed
Start by finding out whether you run this software at all. It is a downloadable PHP sample project, often installed for learning or as a quick internal tool, so it may sit on a forgotten server.
On the web server, search the application folder for the file and the parameter named in the record.
find /var/www -name "student_signup.php" 2>/dev/null
grep -rnE "\$_(GET|POST|REQUEST)" /var/www/path/to/app | grep -i "Username"
Replace the path with your install folder. In the hits, look for the Username value being placed straight into an SQL string. That is the weakness class, and a prepared statement with bound parameters is the fix pattern.
Then check the access log for requests to /student_signup.php from addresses you do not recognise, and for unusual characters such as quotes in the Username value.
grep "student_signup.php" /var/log/apache2/access.log | tail -n 50
Adjust the log path for your server. A clean log does not prove safety, since public tooling probes these pages quickly, but it tells you whether anyone has been looking.
For application code you build or deploy, the free in-browser dependency scan at gold.safeguard.sh/scan covers your third party packages, and the Gold directory lets you look up a CVE like this one by id. Neither replaces reading hand written code, so pair them with a code review of query and upload handling.
What to do now
- Take /student_signup.php off the public internet, or put the whole application behind a VPN or an allow list of known addresses.
- Review every query in the application that uses a request value. Rewrite them as prepared statements with bound parameters, starting with the Username handling in /student_signup.php.
- Run the database account with the fewest rights the app needs. It should not own other schemas or hold file write rights.
- Add a web application firewall rule for SQL metacharacters as a stopgap. It is a delay, not a fix.
- Check the vendor page and the project listing for a patched release, and read the advisory again before you assume none exists.
- If this app holds real personal or financial data, treat it as potentially exposed, rotate credentials stored in its database and review backups.
- If you cannot fix it, retire it. A sample project with no maintainer is a poor home for production data.
Why it matters
The cause is a familiar one. The application takes the Username value from the request and builds an SQL statement by joining strings. The database cannot tell the developer's query from the attacker's text. This is CWE-74 (Injection) and CWE-89 (SQL Injection). NVD lists the broader injection class together with the specific SQL form.
The fix is not clever. Prepared statements keep the query shape fixed and send values separately. The same pattern, repeated across many sample projects, explains why this CVE is one of a long run of near identical records.
The affected code handles account creation, a function that has to be open to visitors who are not yet users. That means the exposed surface cannot be hidden behind a sign-in.
The record says an exploit has been made public. That is not the same as exploitation in the wild. This CVE is not in CISA's Known Exploited Vulnerabilities catalog, and nothing I fetched claims active attacks. Still, public details lower the effort for anyone who goes looking for installs.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2025-9763 exploited in the wild?
The record does not say so and the CVE is not in the CISA Known Exploited Vulnerabilities catalog. It does say an exploit has been made public, so treat exposure as real.
Is there a patched version of Online Learning Management System?
I could not confirm one. Check the vendor page and project listing, and fix the query handling yourself if you must keep running the app.
Sources
- Gold page for CVE-2025-9763
- NVD record data for CVE-2025-9763, as held in the Safeguard content batch
- Reporter write-up: https://github.com/gggg6886/CVE/issues/3
Source note: the only advisory material I could read for this CVE is a public GitHub issue from the reporter, which I fetched. It is a researcher report, not a vendor advisory, and it does not name a fixed version.
Last reviewed: 18 October 2026.
