Description

A weakness has been identified in code-projects Internship Management System 1.0. This vulnerability affects unknown code of the file /admin/login.php of the component Admin Login Form. Executing a manipulation of the argument Password can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-20T11:16:58.307Z",
  "pubdate": "2026-09-20T11:16:58.307Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the Internship Management System 1.0, specifically residing within the admin login interface.\nThe vulnerability originates from improper neutralization of user-supplied data within the Password parameter in the /admin/login.php file.\nThis flaw allows remote, unauthenticated attackers to manipulate backend database queries, potentially leading to unauthorized administrative access, data exfiltration, or complete system compromise.\nBecause the exploit is publicly available, the risk to deployments of this software is high.\nThe attack does not require prior authentication, making it a significant threat to the confidentiality and integrity of the administrative user database.",
  "technicalDetails": "The vulnerability exists within the /admin/login.php file, which handles the authentication logic for the administrative portal. The application fails to properly sanitize or parameterize the 'Password' input before incorporating it into a database query string.\nRoot Cause Analysis: The application likely employs raw SQL queries to verify administrative credentials. By injecting malicious SQL syntax into the 'Password' parameter, an attacker can alter the structural integrity of the intended query. This effectively bypasses the authentication mechanism by manipulating the logical conditions of the 'WHERE' clause, such as forcing a boolean TRUE evaluation (e.g., 'OR 1=1').\nAttack Flow: 1. The attacker targets the login page accessible at /admin/login.php. 2. The attacker submits a specially crafted SQL payload via the 'Password' argument. 3. The backend database management system processes the tainted query, executing the injected commands as part of the authentication request. 4. If the injection is successful, the application may return a session token or redirect the attacker to the administrative dashboard without possessing valid credentials.\nExploitation Requirements: The attack is performed remotely over standard network protocols (HTTP/HTTPS). It requires no prior authentication and exploits the lack of prepared statements or robust input filtering on the server-side processing script.\nPost-Exploitation Impact: Beyond authentication bypass, this class of vulnerability facilitates deeper database interaction. Depending on the database configuration and user permissions, an attacker may perform unauthorized SELECT queries to dump administrative tables, modify user credentials, or, in some configurations, execute administrative operations on the underlying host operating system via features like 'xp_cmdshell' or equivalent database-level functions.\nThe scope of this issue is confined to the administrative authentication component, but its impact is critical due to the potential for full administrative account takeover."
}