A vulnerability exists in the Intern Membership Management System version 1.0 that allows an external actor to manipulate the activity_id parameter in edit_activity.php. By submitting crafted input, an attacker can trigger an SQL injection that permits arbitrary SQL statements to be executed against the underlying database. This can result in unauthorized disclosure or alteration of data stored by the application.

The affected product is Intern Membership Management System from code‑projects, version 1.0, specifically the file /intern/admin/edit_activity.php. The injection is tied to the activity_id argument used within the administrative interface.

The vulnerability carries a CVSS score of 5.1, indicating moderate severity. The EPSS score is below 1%, reflecting a low probability of exploitation at present, although the exploitation code has been made public. The vulnerability is not listed in CISA’s KEV catalog. Attackers can reach the vulnerable endpoint over the network; remote exploitation is possible, and without mitigation an attacker could inject SQL commands that compromise database confidentiality and integrity.