A critical SQL injection vulnerability in the code-projects Intern Membership Management System 1.0 allows unauthenticated attackers to compromise sensitive database information.

The application is vulnerable to SQL injection within the check_admin.php file. An unauthenticated attacker can execute malicious SQL commands by manipulating the Username parameter during a POST request to the administrative login endpoint.

Successful exploitation of this vulnerability permits unauthorized access to the backend database, potentially leading to the theft of sensitive user data or administrative credentials. Given the CVSS score of 7.3, this represents a high-risk security flaw that could result in significant data exfiltration and compromise the integrity of the membership management platform.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /intern/admin/ directory, specifically the check_admin.php file, to trusted IP addresses only.

Proactive Monitoring: Security teams should audit web server logs for suspicious POST requests containing SQL syntax or unusual characters within the username field, particularly targeting the /intern/admin/check_admin.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious traffic targeting the vulnerable login parameter before it reaches the application.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked researcher write-up on GitHub.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to affected systems. Organizations utilizing this software should prioritize network-level restrictions and WAF filtering immediately, while monitoring for vendor updates to address the underlying code flaw.