Intern Membership Management System
CVE-2025-8339
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Login form is network-accessible with no auth required (AV:N, PR:N); SQL injection scope is limited to the application's own database with no scope change (S:U, C:L/I:L/A:L).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in code-projects Intern Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the file /student_login.php. The manipulation of the argument user_name/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in code-projects Intern Membership Management System 1.0 allows unauthenticated remote attackers to manipulate the user_name and password parameters of the /student_login.php login endpoint, injecting arbitrary SQL logic into the backend database query. The flaw (CWE-74) can enable authentication bypass, unauthorized access to intern records, and potential data manipulation. Publicly available exploit code exists on GitHub, though EPSS sits at 0.07% (20th percentile) and the product is absent from CISA KEV, indicating no confirmed widespread exploitation at time of analysis.
Technical ContextAI
The affected component is the PHP login handler /student_login.php in Intern Membership Management System version 1.0 (CPE: cpe:2.3:a:carmelo:intern_membership_management_system:1.0:*:*:*:*:*:*:*), a small open-source PHP web application distributed via code-projects.org. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), specifically classic SQL injection: the user_name and password POST parameters are concatenated directly into SQL query strings without parameterization, prepared statements, or input sanitization. This allows an attacker to alter the query's logical structure, bypassing WHERE-clause authentication checks or issuing UNION-based queries to extract data from the underlying relational database.
RemediationAI
No vendor-released patch has been identified at time of analysis. The immediate priority is to restrict network access to the /student_login.php endpoint via web server configuration - for Apache, an .htaccess deny directive limiting access to trusted IP ranges; for nginx, a location block with deny all - noting that this will impact legitimate users who need remote login access. If the application must remain publicly accessible, deploying a Web Application Firewall rule to block SQL metacharacters (', --, ;, UNION, SELECT) in POST body parameters can reduce exploitation risk, though WAF rules are bypassable by determined attackers and should not be treated as a permanent fix. The definitive remediation is a source-code fix: replacing all string-concatenated SQL queries in /student_login.php with parameterized queries or PDO prepared statements in PHP. See the exploit disclosure at https://github.com/shenxiauguguitian/intern-mms-vuln/blob/main/README.md for reproduction details and VulDB ctiid.318291 at https://vuldb.com/?ctiid.318291 for additional context.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today