EUVD-2026-83722
GHSA-f492-8v38-j2rc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach employer login page
-
ExploitSubmit SQLi payload in Password field
-
ExecutionBypass auth / dump database
-
ImpactExfiltrate employer and applicant data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against a default installation of code-projects Internship Management System 1.0; the vulnerable /employer/login.php endpoint is a public login form requiring no authentication or user interaction. The only real limiter is exposure: the target must be an internet-reachable instance of this specific niche application. A public exploit lowers the skill barrier, but the tiny deployment footprint constrains realistic mass exploitation. |
| Impact | This is a high-CVSS-but-low-real-priority issue. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) correctly reflects a pre-authentication SQL injection reachable remotely with no user interaction against the /employer/login.php form, which is genuinely serious in the abstract. However, the vendor's 6.9 score understates the true technical impact: a login-form SQL injection typically allows full database extraction and authentication bypass, so VC:L is arguably VC:H (I dispute the confidentiality rating upward). The countervailing signal is exploitation likelihood and reach: no EPSS score and no CISA KEV listing are provided, and the SSVC exploitation maturity is only 'Proof-of-Concept' (E:P), not active exploitation. A public POC exists (GitHub zzzxc643/CVE1 vul7), so weaponization is trivial, but this is POC availability, not evidence of in-the-wild use. Critically, the affected product (code-projects Internship Management System 1.0) is a hobbyist PHP application with negligible production footprint, so despite the easy exploit the real-world attack surface is tiny. Net: technically valid pre-auth SQLi with public exploit code, but low operational priority due to rare deployment. |
| Exploit ScenarioDerived | A remote unauthenticated attacker sends a crafted POST to /employer/login.php with a SQL injection payload in the Password field, bypassing authentication and/or extracting the backend database (credentials, applicant/employer records). Public exploit code (GitHub zzzxc643/CVE1 vul7) documents the request, making exploitation trivial. Given AV:N/AC:L/PR:N, no special access or user interaction is needed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Unauthenticated SQL injection in the /employer/login.php login form of code-projects Internship Management System 1.0 lets remote attackers inject arbitrary SQL through the Password parameter, potentially reading or altering the underlying database. The flaw is remotely reachable without credentials or user interaction, and publicly available exploit code exists (VulDB-reported, with a public PoC write-up linked from the CVE record); no CISA KEV listing indicates confirmed active exploitation. Although the independent assessment rates the technical severity as high (CVSS 3.1 8.3-adjacent vector: AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact), real-world priority is low because the application is a niche, code-projects.org PHP teaching/demo system with a very small internet-facing deployment footprint.
RemediationAI
No vendor-released patch identified at time of analysis; code-projects has not published a fixed version, so remediation must be compensatory. Primary action: stop exposing the application to untrusted networks - bind it to localhost or an internal-only interface, or place it behind a VPN/reverse proxy with IP allowlisting, which fully removes the remote attack surface but breaks any legitimate external employer access. Secondary: rewrite the /employer/login.php query to use parameterized prepared statements (e.g. PDO/mysqli bind parameters) so the Password value cannot alter query structure, and add server-side input validation/escaping plus generic error handling that does not leak SQL errors; trade-off is that this requires source-level code maintenance the project may no longer support. If the application is not operationally required, decommissioning or replacing it is the safest option. Short-term virtual patching via a WAF rule that blocks SQLi metacharacters and known payload patterns on requests to /employer/login.php provides partial protection but can be bypassed by encoding tricks and may generate false positives on legitimate logins. Additionally, enable database query logging and alerting on anomalous statements from the web tier, and monitor the referenced VulDB advisory (https://vuldb.com/vuln/407938) for a future official fix; until then, treat any internet-facing instance as compromised-capable and review database contents for tampering.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected software is a PHP-based web application, code-projects Internship Management System 1.0, identified by the CPE cpe:2.3:a:code-projects:internship_management_system (version wildcard, i.e. all 1.x builds of the project). The root cause class is CWE-89, Improper Neutralization of Special Elements used in an SQL Command (SQL Injection): the employer login handler at /employer/login.php takes the user-supplied Password argument and interpolates it into a backend SQL query without parameterization or proper escaping, so crafted input alters the query's structure rather than being treated as data. Because the endpoint is a public login form, the vulnerable code path is reachable pre-authentication, and successful injection can subvert the login check itself and expose or modify records in the application's database. This class of flaw is a well-understood, easily automated attack against PHP login scripts that use string-concatenated queries, which is why proof-of-concept exploit code was published quickly.
Know when Internship Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Pre-auth login-form SQLi is network, low-complexity, no privileges/interaction (PR:N/UI:N); it enables full DB read and auth bypass so C:H/I:H, with limited availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in code-projects Internship Management System 1.0. This affects an unknown part of the file /employer/login.php. Performing a manipulation of the argument Password results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Internship Management System
View allSQL injection in the Admin Login Form of Code-Projects Internship Management System 1.0 lets remote attackers manipulate
Unauthenticated SQL injection in the /login.php login form of code-projects Internship Management System 1.0 allows remo
SQL injection in code-projects Internship Management System 1.0 permits unauthenticated remote attackers to manipulate t
SQL injection in code-projects Internship Management System 1.0 exposes authenticated employer accounts to database quer
Exploit-DB