An unauthenticated remote SQL injection vulnerability in code-projects Intern Membership Management System 1.0 poses a significant risk of unauthorized database access and potential data exfiltration.

This vulnerability is a SQL injection flaw located in the /admin/edit_admin_query.php file, which fails to properly sanitize the Username argument. The attack vector is remotely exploitable and requires no prior authentication to trigger.

Successful exploitation of this SQL injection vulnerability could allow an attacker to bypass authentication, extract sensitive membership data, or modify administrative records within the application. Given the CVSS score of 7.3, this flaw represents a significant risk to the confidentiality and integrity of the system, necessitating immediate attention to prevent unauthorized access.

Immediate Action: As no official patch is currently available, administrators should immediately restrict network access to the /admin/ directory using IP allowlisting or VPN requirements.

Proactive Monitoring: Review web server access logs for suspicious URL parameters containing SQL syntax, such as UNION, SELECT, or comment characters, directed toward the edit_admin_query.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule specifically configured to block malicious SQL injection patterns targeting the Username parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as detailed in the referenced security write-up.

The presence of a publicly disclosed proof-of-concept makes this vulnerability an immediate priority for all organizations running the Intern Membership Management System. Organizations must enforce strict network-level access controls and monitoring while waiting for a vendor-supplied patch, as this flaw allows for trivial exploitation by unauthenticated remote actors.