# CVE-2026-93978: code-projects Internship Management System SQL injection in login

Source: https://junglewise.ai/threats/cve-2026-93978-a-vulnerability-was-identified-in-code-projects-internship  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-20. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93978 · Severity: high · CVSS 7.3 · Published 2026-09-20

The Internship Management System is a PHP-based staff and student management application. An unauthenticated attacker can inject malicious SQL code through the login password field to extract sensitive database records, such as customer credentials. This time-based blind SQL injection allows attackers to systematically retrieve data from the database by measuring response delays.

Technologies: [Code-Projects Internship Management System](https://junglewise.ai/threats/technologies/internship-management-system). Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-93978 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93978 being exploited in the wild.

**How severe is CVE-2026-93978?** High severity, with a CVSS score of 7.3, published 20 September 2026.

**Which products and versions are affected?** Code-Projects Internship Management System 1.0.

**Is there a fix for CVE-2026-93978?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93978 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-93978?** Check whether you run Code-Projects Internship Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A time-based blind SQL injection vulnerability exists in /login.php (lines 40–42) where the password parameter from $_POST is concatenated directly into a SQL query without escaping or prepared statements. An unauthenticated attacker can inject SQL expressions such as "and (select sleep(5))" to confirm injection and extract data character-by-character from any database table. The vulnerability requires no authentication and can be exploited remotely via HTTP POST requests.

## Affected products

- code-projects Internship Management System 1.0

## Timeline

- 2026-09-20: disclosed
- exploited: Exploit is publicly available and might be used

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://github.com/zzzxc643/CVE1/blob/main/2026-8-24/vul6.md](https://github.com/zzzxc643/CVE1/blob/main/2026-8-24/vul6.md)

## Related threats

- [code-projects Internship Management System SQL injection in admin login](https://junglewise.ai/threats/cve-2026-93980-a-weakness-has-been-identified-in-code-projects-internship)
- [code-projects Internship Management System SQL injection in login](https://junglewise.ai/threats/cve-2026-93979-a-security-flaw-has-been-discovered-in-code-projects-internship)
- [code-projects Internship Management System SQL injection in change_password.php](https://junglewise.ai/threats/cve-2026-14701-code-projects-internship-management-system-sql-injection-in)
- [code-projects Internship Management System SQL injection in employer login](https://junglewise.ai/threats/cve-2026-14700-code-projects-internship-management-system-sql-injection-in)