Executive brief
An internship management web application contains a time-based blind SQL injection vulnerability in the admin login form. An unauthenticated attacker can exploit the unfiltered password parameter to extract database contents, including plaintext credentials, without needing valid credentials. This can lead to administrative account takeover and full system compromise.
Technical details
The admin/login.php file concatenates the password parameter directly into an SQL query without escaping or prepared statements (CWE-89). An unauthenticated attacker can inject SQL expressions like "sleep(2)" to trigger time-based blind exfiltration. By measuring response delays, the attacker can extract plaintext credentials from the users table character by character and gain admin access.
Affected products
- code-projects Internship Management System 1.0
Timeline
- 2026-09-20: disclosed