Description
A security vulnerability has been detected in code-projects Intern Membership Management System 1.0. This issue affects some unknown processing of the file /intern/admin/delete_admin.php. Such manipulation of the argument admin_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-01-08
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Patch
AI Analysis

Impact

Intern Membership Management System 1.0 includes a vulnerability in delete_admin.php where the admin_id parameter is used directly in a SQL query without proper sanitization, allowing an attacker to inject arbitrary SQL commands. This flaw enables remote attackers to manipulate the database if they can access the endpoint and supply a malicious admin_id value. The vulnerability is publicly disclosed and may be used.

Affected Systems

The vulnerability is present in the Intern Membership Management System version 1.0 released by code-projects. Any installation of this version that exposes delete_admin.php to external requests is potentially impacted.

Risk and Exploitability

With a CVSS score of 5.1 the flaw is classified as medium severity. The EPSS score is less than 1%, indicating a very low likelihood of active exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the exposed endpoint via the web interface; authentication requirements for accessing delete_admin.php are not specified in the CVE data.

Generated by OpenCVE AI on April 18, 2026 at 19:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor patch or upgrade that addresses CVE-2026-0728.
  • Modify delete_admin.php to use prepared statements or parameterized queries instead of concatenating the admin_id value into raw SQL.
  • Restrict the database user used by the application to the minimum privileges necessary for legitimate operations, limiting permissions to affect only allowed tables.

Generated by OpenCVE AI on April 18, 2026 at 19:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Jan 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Carmelo
Carmelo intern Membership Management System
CPEs cpe:2.3:a:carmelo:intern_membership_management_system:1.0:*:*:*:*:*:*:*
Vendors & Products Carmelo
Carmelo intern Membership Management System

Fri, 09 Jan 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects intern Membership Management System
Vendors & Products Code-projects
Code-projects intern Membership Management System

Thu, 08 Jan 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Jan 2026 20:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in code-projects Intern Membership Management System 1.0. This issue affects some unknown processing of the file /intern/admin/delete_admin.php. Such manipulation of the argument admin_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
Title code-projects Intern Membership Management System delete_admin.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Carmelo Intern Membership Management System
Code-projects Intern Membership Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T08:23:48.633Z

Reserved: 2026-01-08T15:08:10.022Z

Link: CVE-2026-0728

cve-icon Vulnrichment

Updated: 2026-01-08T20:46:39.720Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-08T21:15:44.053

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-0728

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T19:30:08Z

Weaknesses