A web application built with Intern Membership Management System version 1.0 contains a flaw in add_admin.php where the Username argument is not sanitized. This flaw permits attackers to inject arbitrary SQL statements into database queries, enabling unauthorized data disclosure, modification, or escalation of privileges.

The vulnerability exists in Intern Membership Management System version 1.0, released by code-projects. It affects installations that expose the /intern/admin/add_admin.php page, including standalone deployments referenced in the cpe identifier.

The CVSS score of 5.1 indicates moderate severity. The EPSS score of less than 1% signals a low current exploitation probability, but the exploit is publicly available. The vulnerability is not yet catalogued in CISA's KEV list. An attacker can exploit it remotely by submitting a crafted Username field through the web interface, which is then executed as raw SQL. If successful, the attacker could add administrative users or read sensitive data if appropriate database permissions exist.