An unauthenticated SQL injection vulnerability in the Internship Management System login form allows remote attackers to extract sensitive database information.

The application fails to sanitize the password parameter in login.php before including it in a database query, allowing an unauthenticated attacker to execute arbitrary SQL commands. This flaw leverages a time-based blind injection technique to infer data from the backend database.

Successful exploitation of this vulnerability permits unauthorized access to sensitive data stored in the backend database, such as user credentials or customer information. Given the CVSS score of 7.3, this represents a high-risk security flaw that could lead to full database compromise and significant reputational damage.

Immediate Action: Since no official patch is currently available, users should restrict external access to the login.php endpoint or disable the application until a secure version is released.

Proactive Monitoring: Monitor web server access logs for anomalous POST requests to login.php, specifically identifying patterns containing SQL syntax or unusual response delays indicative of time-based injection attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block malicious SQL injection payloads targeting the password parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up by the vulnerability reporter.

The severity of this SQL injection vulnerability necessitates immediate attention, as it provides an unauthenticated attacker with a direct path to database manipulation. Administrators must prioritize limiting exposure of the login interface and monitor for suspicious traffic until the vendor provides a formal security update to replace the vulnerable code.