An attacker can manipulate the Password input in the /employer/login.php page of code-projects Internship Management System to inject arbitrary SQL. The flaw is a classic SQL injection (CWE‑89) that also involves improper handling of input (CWE‑74). Exploiting the vulnerability allows a remote attacker to bypass authentication, read sensitive data, alter or delete records, and potentially execute further destructive queries. The impact is a compromise of database confidentiality and integrity, and could enable further privilege escalation.

The affected product is code‑projects Internship Management System version 1.0. The flaw resides in the login functionality provided by the /employer/login.php module.

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. The attack can be carried out remotely over the network by submitting a crafted HTTP request to the login page. Publicly released exploit code suggests that an attacker does not need prior authentication to leverage the flaw.