A flaw in the Intern Membership Management System’s check_admin.php file allows a malicious actor to manipulate the Username parameter and inject arbitrary SQL commands. The vulnerability permits remote exploitation, enabling an attacker to read, modify, or delete database records without authentication. The impact is the compromise of confidential data stored in the system’s backend.

The affected product is code‑projects Intern Membership Management System, version 1.0. The vulnerability originates in the check_admin.php file located at /intern/admin/check_admin.php, a component of the system's administrative interface.

The CVSS score of 6.9 indicates moderate severity, and an EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation. The issue is not listed in the CISA KEV catalog, yet it has been publicly disclosed and can be leveraged over the network. Because the attack relies on unsanitized user input, exploitation does not require privileged credentials and could be achieved by remote actors with network access to the application.