EUVD-2026-83721
GHSA-gh22-w3hx-vq5f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed /login.php instance
-
ExploitSubmit SQLi payload in Password field
-
ExecutionBypass auth or extract database
-
ImpactExfiltrate credentials and stored records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated SQL injection reachable at /login.php against default installations of code-projects Internship Management System 1.0; the injectable Password parameter is on the public pre-authentication login page, so no credentials, roles, or user interaction are required. The primary limiting factor is exposure/prevalence: the affected software is a niche hobbyist PHP project unlikely to be internet-exposed in production, and successful data extraction depends on the backend DBMS and query structure. Only version 1.0 is listed as affected. |
| Impact | This is a pre-authentication SQL injection in the login form (/login.php, Password argument) of code-projects Internship Management System 1.0, a signal that materially raises real risk versus a post-auth flaw: the CVSS 4.0 vector confirms AV:N/AC:L/PR:N/UI:N - network-reachable, low complexity, no authentication, no user interaction. The E:P (Proof-of-Concept) exploit maturity plus a publicly hosted PoC (GitHub zzzxc643/CVE1) means working exploit code exists, though there is no EPSS score and no CISA KEV listing, so exploitation is unproven at scale - consistent with an obscure product rather than a mass-exploited target. The vendor's overall 6.9 is moderated by its choice of VC:L/VI:L/VA:L (limited impact); I dispute the confidentiality metric: SQL injection at a login boundary typically enables full database extraction (credential/user data dump) and often authentication bypass, which argues for VC:H/C:H rather than VC:L. The decisive mitigating factor is not the CVSS metrics but deployment footprint: this is a hobbyist PHP training project with negligible production presence, so despite a genuinely unauthenticated remote SQLi, real-world priority is low - patch/replace where deployed but it is not an enterprise fleet-wide emergency. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted POST to /login.php with a SQL-injection payload in the Password field, using a classic tautology or UNION/error-based technique to bypass authentication or dump the backend database (user accounts, credentials, internship records). A public PoC exists (GitHub zzzxc643/CVE1), lowering the skill barrier; because the vector is AV:N/AC:L/PR:N/UI:N, the request can be automated against any exposed instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Unauthenticated SQL injection in the /login.php login form of code-projects Internship Management System 1.0 allows remote attackers to manipulate the Password parameter and inject arbitrary SQL into the backend query, with public exploit code already available (no CISA KEV confirmation of active exploitation). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the independent 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) both confirm this is a pre-authentication, network-reachable flaw requiring no credentials and no user interaction, which materially raises risk versus a post-auth injection. Practical exposure is limited mainly by prevalence: this is a niche hobbyist-style PHP project, and successful data extraction depends on the backend DBMS and query structure, so exploitation in the wild against internet-facing production deployments is plausible but constrained.
RemediationAI
No vendor-released patch identified at time of analysis, and the reference set contains no GitHub PR, commit, or fixed release for this project, so remediation must be defensive. The direct code fix is to replace string-concatenated SQL in /login.php with parameterized queries or prepared statements (PDO/mysqli with bound parameters) for the Password argument, and if maintaining the project is not feasible, remove it from any internet-facing deployment - this application class is intended as a learning/demo project, so the cleanest control is not exposing it publicly. Where the app must remain reachable, put it behind authentication or network restrictions (VPN, IP allowlisting, or a reverse proxy) so that /login.php is not publicly reachable; the trade-off is loss of open access for legitimate users. A WAF or reverse-proxy rule blocking common SQLi metacharacters and tautology patterns on POST bodies to /login.php provides short-term mitigation, but it is signature-based and can be bypassed with encoding or alternate syntax, so it must not be treated as a substitute for fixing the query. Additional hardening: disable verbose database error output so injection feedback is not leaked to attackers, run the application against a least-privilege database account so an injection cannot read or modify unrelated schemas, and consider that because exploit code is publicly available (https://github.com/zzzxc643/CVE1/blob/main/2026-8-24/vul6.md), any exposed instance should be treated as compromised and logs reviewed for anomalous login and query activity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-89 SQL injection in a PHP web application. The affected component is the public, pre-authentication login page /login.php, where the Password request argument is incorporated into a database query without proper parameterization or escaping, allowing an attacker to alter the query's logic (for example to bypass authentication or extract records from backend tables). Because the injectable parameter sits on the login form itself, the attack surface is reachable before any credential check - the CVSS vectors from both the NVD-style CVSS 4.0 entry (PR:N/UI:N) and the independent CVSS 3.1 assessment (PR:N/UI:N) agree that no authentication or user interaction is required. The supplied CPE cpe:2.3:a:code-projects:internship_management_system:*:*:*:*:*:*:*:* and the ENISA EUVD entry (EUVD-2026-83721) both scope the issue to Internship Management System 1.0, a single-release PHP project from code-projects.org; the wildcard version in the CPE reflects the vendor's unversioned packaging rather than a confirmed multi-version impact. The independent assessment notes that the exact severity of data compromise depends on the backend DBMS and the structure of the underlying query, while rating confidentiality impact as High.
Know when Internship Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Pre-auth login-form SQLi is remote, low-complexity, no privileges/interaction (PR:N/UI:N); confidentiality high due to full DB read, with limited integrity/availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in code-projects Internship Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Such manipulation of the argument Password leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Internship Management System
View allSQL injection in the Admin Login Form of Code-Projects Internship Management System 1.0 lets remote attackers manipulate
Unauthenticated SQL injection in the /employer/login.php login form of code-projects Internship Management System 1.0 le
SQL injection in code-projects Internship Management System 1.0 permits unauthenticated remote attackers to manipulate t
SQL injection in code-projects Internship Management System 1.0 exposes authenticated employer accounts to database quer
Exploit-DB