An unknown function in /intern/admin/edit_admin.php allows attackers to manipulate the admin_id argument, resulting in an SQL injection flaw. By sending crafted values for admin_id, an adversary can embed arbitrary SQL statements into the database query. The consequence is the potential to read, modify, or delete data stored in the application’s database, thereby compromising the confidentiality and integrity of sensitive information and administrative records.

The vulnerability affects the code-projects Intern Membership Management System version 1.0. All users running this version operate the edit_admin.php endpoint that is susceptible to the injection flaw. The vulnerability is identified by the corresponding CPE but is not limited to any specific deployment topology or configuration beyond the presence of the default edit_admin.php file.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The flaw is not listed in the CISA KEV catalog, but published exploit code exists, implying that an attacker could launch a remote attack by submitting a malicious admin_id parameter to the edit_admin.php page. The revised context stresses the need to control remote access to this endpoint and to monitor for exploitation attempts.