The Intern Membership Management System 1.0 has a flaw in the add_activity.php file that allows an attacker to manipulate the Title parameter and inject arbitrary SQL commands. This SQL injection can be executed remotely and may allow the attacker to read, modify, or delete database records, compromising confidentiality and integrity of the system data. The weakness corresponds to CWE-89 and is further facilitated by the parameter handling described in CWE-74.

The vulnerability affects the Intern Membership Management System 1.0 developed by code-projects. No other versions or related products are listed as affected.

The CVSS score of 5.1 indicates a medium severity risk, while the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can reach the vulnerable point via a web form that accepts the Title argument, making remote exploitation possible for anyone who can access the application. If the database account used by the application has sufficient privileges, the consequences could include unauthorized data disclosure or tampering.