The code-projects Internship Management System 1.0 contains a SQL injection vulnerability in the /login.php file. Specifically, the Password argument can be manipulated to inject SQL commands, potentially allowing unauthorized database access or manipulation. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit code exists, but there is no evidence of widespread exploitation. No patch or remediation information is provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely without authentication. This could lead to unauthorized data access, modification, or other database impacts depending on the database privileges of the application. However, no active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing input validation and parameterized queries to mitigate SQL injection risks in the /login.php Password parameter. Monitor vendor channels for updates and apply patches promptly once released.