This vulnerability in code-projects Internship Management System 1.0 allows remote attackers to perform SQL injection via the 'Current' parameter in the employer/details/change_password.php component. The flaw exists in the Password Change Endpoint, enabling injection of malicious SQL commands. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is publicly known but no official fix or patch has been disclosed as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database through the vulnerable 'Current' parameter. This may lead to unauthorized data access or modification related to password changes. The attack can be performed remotely without user interaction and requires low complexity, increasing the risk of exploitation. However, the overall impact is rated medium due to limited privileges required and low scope impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint where possible and monitor for suspicious activity related to password change requests. Avoid using the vulnerable version 1.0 in production environments if possible.