EUVD-2026-83723
GHSA-3rvf-ff9w-xrcr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed /admin/login.php
-
DeliverySubmit SQLi payload in Password field
-
ExploitBreak authentication query logic
-
ExecutionBypass admin login or dump database
-
ImpactExfiltrate credentials and application data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against a default installation of code-projects Internship Management System 1.0, targeting the Password parameter of the Admin Login Form at /admin/login.php. The only meaningful limiting factor is deployment scarcity: this is an obscure open-source PHP project rarely exposed on production internet-facing hosts, so exploitation is constrained by the small number of reachable installs rather than by any technical precondition. |
| Impact | This is a classic high-nominal-severity-but-modest-real-priority SQL injection. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) makes it remotely reachable with no authentication and low complexity - the Password parameter on the admin login form is a pre-auth attack surface - and E:P plus a public POC on GitHub confirms working exploit code exists. However, the vendor scored technical impact conservatively at VC:L/VI:L/VA:L, yielding only 5.5. I assess that impact rating as too low: SQL injection on a login form typically enables full database extraction and authentication bypass into the admin panel, which is closer to VC:H. The countervailing signal is prevalence and threat interest: there is no EPSS score, no CISA KEV listing, and the sole reporter/source is VulDB with a hobbyist-project POC. code-projects Internship Management System 1.0 is an obscure open-source PHP demo app with negligible production footprint, so despite the pre-auth/public-exploit combination, real-world exploitation is opportunistic and low-volume rather than a widespread priority. Exploitation status: publicly available exploit code exists (not confirmed actively exploited - no KEV). |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted POST to /admin/login.php with a SQL injection payload in the Password field, tampering with the authentication query to either bypass the admin login or extract database contents (credentials, applicant/employer data). A public proof-of-concept is available on GitHub (zzzxc643/CVE1, vul9.md), lowering the skill barrier, though only obscure code-projects deployments are affected. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
SQL injection in the Admin Login Form of Code-Projects Internship Management System 1.0 lets remote attackers manipulate the Password parameter of /admin/login.php to inject arbitrary SQL into the backend database query. Per the CVSS 4.0 vector the flaw is reachable without authentication (PR:N, AV:N, AC:L), and publicly available exploit code exists - a public proof-of-concept write-up is referenced in the CVE record - so exploitation requires no special conditions against a default installation. The practical risk is tempered by deployment scarcity: this is an obscure open-source PHP student-style project that is rarely exposed on production internet-facing hosts, and there is no indication of confirmed active exploitation (not listed in CISA KEV).
RemediationAI
No vendor-released patch identified at time of analysis - the Code-Projects project has no published fixed build, and the only remediation reference is the third-party PoC write-up, so administrators must remediate at the code or network layer. The most direct fix is to rewrite the authentication query in /admin/login.php using parameterized statements (PDO with bound parameters or mysqli_prepare/mysqli_stmt_bind_param) instead of string concatenation, so the Password value is treated strictly as data; enforce a server-side input length/type check on the Password field as a secondary control. Where code changes are not feasible, the highest-value compensating control is to remove the admin panel from the public internet - bind /admin/ to a management VLAN, require VPN or reverse-proxy HTTP authentication in front of it - which fully blocks the attack path but also prevents legitimate off-site administrator access. A WAF rule targeting SQLi metacharacters in the Password parameter of /admin/login.php provides interim coverage but will generate false positives on passwords containing quotes and can be bypassed with obfuscated payloads. Additional hardening with lower cost and fewer side effects includes rate-limiting or lockout on repeated /admin/login.php failures (mitigates brute-force and slows injection probing, but risks locking out legitimate admins), running the database account used by the application with least privilege so injected queries cannot read unrelated schemas, and disabling detailed SQL error display so error-based extraction and schema enumeration are harder.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is a PHP web application (Code-Projects Internship Management System 1.0) whose administrative authentication routine at /admin/login.php builds a SQL query from the user-supplied Password value without parameterization, a textbook CWE-89 SQL Injection. The application is backed by a relational database (typical LAMP stack) and the injected value is concatenated directly into the authentication statement, which permits both query-structure manipulation - for example an always-true predicate that bypasses the admin login check - and, depending on query shape and error handling, data exfiltration from the users/admin table via UNION or error-based techniques. The CPE identifier cpe:2.3:a:code-projects:internship_management_system:*:*:*:*:*:*:*:* uses a wildcard version, indicating the vendor has published no fixed build and the flaw is treated as affecting the 1.0 release line as shipped. Note the score divergence: the CVE record carries CVSS 4.0 5.5 with E:P (proof-of-concept maturity), while the independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - the higher confidentiality/integrity impact reflects that an unauthenticated SQLi in an authentication endpoint can compromise the full credential store and database contents, not merely cause partial information disclosure.
Know when Internship Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Pre-auth login-form SQLi is remotely reachable with low complexity and no privileges; injection on the auth query enables full DB read and write/auth-bypass, so C:H/I:H with limited availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in code-projects Internship Management System 1.0. This vulnerability affects unknown code of the file /admin/login.php of the component Admin Login Form. Executing a manipulation of the argument Password can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Internship Management System
View allUnauthenticated SQL injection in the /employer/login.php login form of code-projects Internship Management System 1.0 le
Unauthenticated SQL injection in the /login.php login form of code-projects Internship Management System 1.0 allows remo
SQL injection in code-projects Internship Management System 1.0 permits unauthenticated remote attackers to manipulate t
SQL injection in code-projects Internship Management System 1.0 exposes authenticated employer accounts to database quer
Exploit-DB