Executive brief
The Internship Management System, a web application for managing student placements, contains a security flaw in its employer login page. An attacker can exploit this to bypass authentication or steal sensitive information from the database. This could lead to unauthorized access to employer accounts and the exposure of private internship and user data.
Technical details
A time-based blind SQL injection vulnerability exists in code-projects Internship Management System 1.0 within the 'employer/login.php' file. The application fails to sanitize or parameterize the 'email' and 'password' POST parameters before concatenating them into a SQL query. A remote, unauthenticated attacker can provide specially crafted input to trigger database delays (e.g., using the SLEEP function) or bypass authentication entirely. This flaw allows for the extraction of sensitive database information through blind inference and potentially full compromise of the backend database.
Affected products
- code-projects Internship Management System 1.0
Timeline
- 2026-07-05: advisory: NVD publication date
- 2026-07-05: disclosed: Public disclosure of the exploit details