Executive brief
The Internship Management System, a platform used to manage student internships, contains a security flaw in its password change feature for employers. An attacker with a valid employer account can exploit this to interfere with the underlying database. This could lead to the unauthorized disclosure of sensitive information or disruption of the system's operations.
Technical details
A time-based blind SQL injection vulnerability exists in code-projects Internship Management System 1.0 within the 'Password Change' component. The flaw is located in the file 'employer/details/change_password.php', where the 'current' POST parameter is concatenated directly into a SQL query without proper sanitization or the use of prepared statements. An authenticated attacker with employer-level privileges can provide a malicious payload (e.g., using SLEEP commands) to infer database structure and content based on server response times. This can lead to full database information disclosure or authentication bypass. A public exploit (POC) has been disclosed.
Affected products
- code-projects Internship Management System 1.0
Timeline
- 2026-07-05: disclosed: Initial vulnerability disclosure and CVE assignment.
- 2026-07-05: advisory: NVD and VulDB published the advisory.