Executive brief
The Internship Management System is a PHP-based web application for managing student internship placements. An unauthenticated attacker can inject malicious SQL code through the employer login form's password field, allowing them to extract sensitive data from the database or potentially gain unauthorized access to employer accounts without needing valid credentials.
Technical details
A time-based blind SQL injection vulnerability exists in employer/login.php where the password parameter from $_POST is directly concatenated into a SQL query without escaping or prepared statements. An unauthenticated attacker can exploit this by crafting a payload that breaks out of the SQL string quotes and injects arbitrary SQL commands (e.g., sleep-based time delays) to extract data character by character. A fix requires parameterized queries or prepared statements with proper input sanitization.
Affected products
- code-projects Internship Management System 1.0
Timeline
- 2026-09-20: disclosed: CVE-2026-93979 published