Intern Membership Management System CVE-2025-8339

No special conditions are required beyond network reachability of the /student_login.php login page. The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms unauthenticated, zero-interaction exploitation against a default installation with no prerequisite configuration. The login endpoint must be accessible over the network - if the application is internet-facing, exploitation is possible from any host worldwide. No authenticated session, privileged role, non-default feature flag, or special server configuration is required. The primary limiting factor is the product's niche deployment footprint: organizations not running this specific PHP application are entirely unaffected. There is no evidence of authentication or CSRF protection on the login form that would raise the exploitation bar.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the attack is fully remote, requires no authentication, no special attack requirements, and no user interaction - conditions that would ordinarily demand immediate remediation. The overall CVSS 4.0 score of 5.5, however, reflects bounded impact (VC:L/VI:L/VA:L), consistent with a single-application-scope SQL injection rather than one enabling OS-level compromise or wide lateral movement. EPSS at 0.07% (20th percentile) is notably low for a publicly disclosed SQL injection with a known POC, likely reflecting the product's obscure deployment footprint rather than low exploitability - the technique itself is trivial. The product is not listed in CISA KEV, so active exploitation is not confirmed. The existence of a public GitHub POC is a concrete uplift: any attacker aware of a running instance can exploit it without specialized skill. No vendor patch has been identified, making every deployed instance persistently vulnerable. The realistic risk is bounded by the product's niche audience - this is not enterprise software - but any organization that has deployed it should treat it as high priority given the combination of unauthenticated network access, no-patch status, and public POC.

An unauthenticated attacker submits an HTTP POST request to /student_login.php with a crafted user_name value such as ' OR '1'='1' -- , injecting a tautology into the SQL WHERE clause and bypassing the password check entirely to gain application access. With a UNION-based payload, the attacker can enumerate and extract all database tables including intern credentials and personal records. A public POC on GitHub documents the exact technique, meaning exploitation requires no specialized knowledge beyond basic HTTP tooling.