The vulnerability resides in the Intern Membership Management System version 1.0, specifically within the edit_students.php file. Manipulating the admin_id argument allows an attacker to inject arbitrary SQL statements, which can lead to unauthorized reading, modification, or deletion of database records. The weakness is represented by CWE-74 and CWE-89 and could potentially expose sensitive student and administrative data if exploited.

This flaw affects code-projects’ Intern Membership Management System version 1.0, as identified by its CPE declaration. Administrators running the 1.0 release should recognize that only this specific version is vulnerable and that the issue is confined to the edit_students.php endpoint.

The CVSS vector assigns a 5.1 score, reflecting moderate impact. The EPSS score of less than 1% suggests that exploitation is unlikely in the wild. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed public exploits. The attack vector is remote, and the flaw appears to require the ability to supply a crafted admin_id value to the vulnerable endpoint, with no explicit authentication prerequisites stated in the description.