A critical, unauthenticated SQL injection vulnerability exists in the Internship Management System 1.0 that allows remote attackers to compromise backend database integrity.

This is a time-based blind SQL injection flaw located in the employer/login.php script. An unauthenticated attacker can manipulate the password parameter to execute arbitrary database commands, as the application fails to sanitize input before concatenating it into SQL queries.

Successful exploitation allows an attacker to extract sensitive information from the database, including user credentials and employer data. Given the CVSS score of 7.3, this high-severity vulnerability poses a significant risk to data confidentiality and system integrity, potentially leading to unauthorized administrative access or full database compromise.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /employer/login.php endpoint via network controls or IP allowlisting until a secure update is released by the vendor.

Proactive Monitoring: Review web server and database logs for anomalous request patterns, specifically looking for time-delayed responses or suspicious characters, such as single quotes or SQL keywords, within POST parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, particularly those utilizing time-based functions like sleep().

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked research write-up on GitHub.

The presence of a public proof-of-concept, combined with the ease of exploiting the unauthenticated injection vector, necessitates immediate action. Organizations utilizing the Internship Management System should isolate the affected service from public networks immediately and prioritize the implementation of robust input validation or migration to a more secure management platform.