CVE-2026-14700: SQL Injection in code-projects Internship Management System 1.0 Employer Login

Technical summary

CVE-2026-14700 is a SQL injection flaw in the employer/login.php component that fails to properly sanitize user input in the email and password parameters. The vulnerability maps to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). An unauthenticated remote attacker can craft malicious input to execute arbitrary SQL queries against the underlying database, bypassing authentication and gaining unauthorized access to sensitive information or system integrity.

Business impact

Exploitation could expose employer credentials, student data, and institutional information stored in the system database. A successful attack allows unauthorized access to internship applications, employer details, and potentially sensitive communication records. This creates regulatory compliance risks (data protection laws), reputational damage from a data breach, and potential service disruption if the database is corrupted or locked by the attack.

Affected systems

code-projects Internship Management System version 1.0 is affected. The vulnerability specifically impacts the Employer Login Endpoint (employer/login.php). Any deployment of this application version exposed to network access is at risk, particularly if used in educational institutions managing internship programs.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no user interaction, and can be triggered remotely by sending crafted HTTP requests to the login endpoint. The CVSS score of 7.3 (HIGH) reflects the low barrier to exploitation—an attacker needs only network access and knowledge of the vulnerable parameter names. Public disclosure of the vulnerability further increases the likelihood of active exploitation.

Remediation

Organizations using code-projects Internship Management System 1.0 should immediately discontinue its use or apply a vendor security update if available. Verify patch availability through the vendor's official security advisory. As an interim control, restrict network access to the employer login endpoint using a web application firewall (WAF) or network segmentation to limit exposure until a patch can be deployed.

Patch guidance

Contact code-projects for an official security update addressing this SQL injection flaw. Verify patch version numbers and deployment instructions directly from the vendor's advisory before applying. If the vendor does not provide a patch or the product is unsupported, plan migration to a maintained alternative that includes secure input validation and parameterized queries.

Detection guidance

Monitor web server logs and WAF alerts for unusual patterns in employer/login.php requests, including SQL syntax characters (single quotes, semicolons, SQL keywords like UNION, SELECT) in email or password parameters. Implement database query logging to detect anomalous SQL execution. Look for repeated failed login attempts followed by successful admin access, which may indicate successful SQL injection exploitation.

Why prioritize this

Despite not being on the CISA Known Exploited Vulnerabilities list, this vulnerability merits immediate attention due to its HIGH CVSS score, public disclosure, unauthenticated access requirement, and direct impact on login security. The combination of low exploitation complexity and high data exposure risk makes it suitable for urgent patching. Educational institutions managing sensitive student and employer data should prioritize remediation.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects: Network attack vector (AV:N), low attack complexity requiring only crafted input (AC:L), no privileges required (PR:N), no user interaction needed (UI:N), and impact on confidentiality, integrity, and availability of database contents (C:L/I:L/A:L). This is a realistic baseline; actual risk in your environment depends on network exposure, data sensitivity, and whether compensating controls exist.

Frequently asked questions