Description

A security flaw has been discovered in code-projects Internship Management System 1.0. This affects an unknown part of the file /employer/login.php. Performing a manipulation of the argument Password results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-20T11:16:58.130Z",
  "pubdate": "2026-09-20T11:16:58.130Z",
  "executiveSummary": "The Internship Management System 1.0 is affected by a critical SQL injection vulnerability located within the /employer/login.php file.\nThis vulnerability stems from improper neutralization of special elements used in an SQL command during the processing of the Password argument.\nThe flaw allows remote, unauthenticated attackers to manipulate database queries, potentially leading to unauthorized data access, modification, or bypass of authentication mechanisms.\nGiven that the exploit is publicly available, the risk to affected deployments is high, necessitating immediate remediation to prevent data breaches or system compromise.\nThe vulnerability is accessible over a network, requiring no prior authentication, and facilitates direct interaction with the underlying database management system.",
  "technicalDetails": "The vulnerability is classified as an SQL injection (SQLi) flaw residing in the authentication logic of the /employer/login.php script within the Internship Management System 1.0.\nThe root cause of this vulnerability is the failure of the application to properly sanitize, validate, or parameterize user-supplied input provided via the 'Password' POST parameter before incorporating it directly into an SQL query executed against the backend database.\nIn a typical attack flow, the attacker intercepts or crafts an HTTP POST request targeting /employer/login.php. Instead of providing a legitimate password, the attacker injects malicious SQL syntax into the 'Password' field. For example, injecting a payload such as ' OR '1'='1' can manipulate the query logic to evaluate to true regardless of the actual password, thereby bypassing the intended authentication check.\nBecause the input is concatenated directly into the SQL string, the database interprets the injected characters as control characters rather than literal data. This allows the attacker to alter the query's structure, enabling the retrieval of unauthorized data, modification of existing records, or execution of administrative database commands depending on the privileges of the database user account used by the web application.\nThe vulnerability is remotely exploitable, requiring no prior authentication or administrative privileges. The attacker only needs network access to the target web server. As the exploit is already public, the barrier to entry is minimal, and automated scripts can be utilized to scan for and exploit this weakness indiscriminately.\nPost-exploitation impact is severe, as the attacker can effectively masquerade as an employer or administrator, leading to a complete compromise of the system's data integrity and confidentiality. If the database user is not appropriately restricted, the attacker may also leverage the injection to perform additional actions on the underlying server or database engine, such as extracting sensitive tables, dumping database contents, or, in some configurations, interacting with the file system."
}