A critical SQL injection vulnerability in code-projects Intern Membership Management System 1.0 allows remote unauthenticated attackers to manipulate database queries.

This vulnerability is a SQL injection flaw (CWE-89) located in the /admin/delete_student.php script. The application fails to properly sanitize the ID argument, which allows an unauthenticated remote attacker to inject malicious SQL commands.

The exploitation of this vulnerability can lead to unauthorized access to sensitive student data, potential data modification, or complete database compromise. With a CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the system, potentially resulting in regulatory non-compliance and reputational damage.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the management interface and consider disabling the vulnerable script until a vendor update is released.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the /admin/delete_student.php file, particularly those containing SQL syntax or unusual characters in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to mitigate the risk posed by this vulnerability.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the referenced security write-up.

Given the availability of a public exploit and the lack of a vendor-provided patch, this vulnerability poses a clear and present danger to affected systems. Organizations must prioritize segmenting the vulnerable application from public-facing networks and implementing robust WAF filtering to prevent unauthorized database access until a permanent fix is issued.