CVE Intelligence
Analysis AI-assisted

CVE-2026-0700: code-projects Intern Membership Management System check_admin.php SQL injection

CVE-2026-0700 is an SQL injection flaw (CWE-89) in the file /intern/admin/check_admin.php of code-projects Intern Membership Management System 1.0, triggered through the Username argument and reachable remotely. NVD rates it critical with a CVSS base score of 9.8, and the record says a public exploit has been disclosed. The record does not show the flaw in the CISA KEV catalog, and no confirmed in-the-wild exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes an SQL injection flaw (CWE-89) in the file /intern/admin/check_admin.php of code-projects Intern Membership Management System 1.0. According to the description, manipulating the Username argument can lead to SQL injection, and the attack can be carried out remotely.

Impact

  • If exploited, an attacker could potentially read, alter or delete database content, depending on how the application and database are configured. This is an inference from the CWE class and the description, not a verified outcome.
  • NVD assigns a CVSS base score of 9.8 (critical) with high impact on confidentiality, integrity and availability.
  • VulDB and its CNA record list lower scores, between 5.5 and 7.5, under other CVSS versions. The severity therefore depends on the scoring source.
  • SSVC data in the record shows exploitation status poc, automatable yes and partial technical impact.

Affected products and versions

  • Two product names appear in the record: Carmelo Intern Membership Management System and Code-projects Intern Membership Management System.
  • The only version listed for both is 1.0.
  • The record contains no fixed version and no vendor patch information.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record, so active exploitation is not confirmed by that source.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The record states that an exploit has been publicly disclosed and references a third-party write-up. Public proof-of-concept availability is therefore documented, but the record does not show how widely it is used.
  • The EPSS probability in the record is 0.00441 (percentile 0.37268), a low predicted likelihood of exploitation at the record date.

Remediation and mitigation

  • No vendor fix appears in the record. Check with the project maintainers or the product source for an updated release, and treat the 1.0 version as unpatched until proven otherwise.
  • Restrict access to /intern/admin paths to trusted networks or authenticated users, and remove the application from internet exposure if it is not needed.
  • Ask developers to review database queries that use user-supplied input and to apply parameterized queries and strict input validation.
  • Consider a web application firewall as a temporary compensating control, with the understanding that it does not replace a code fix.

Detection guidance

  • Review web server logs for unusual or repeated requests to check_admin.php, especially those with abnormal Username values or unexpected response sizes.
  • Watch for database error messages returned to clients and for unexpected administrative logins.
  • Check authentication logs for successful logins from unfamiliar sources after any suspicious activity.

Limitations of the available information

  • The record does not identify the exact vulnerable code, the affected parameter handling or the authentication requirements for the endpoint.
  • The record does not include a fixed version, vendor advisory or patch.
  • The EPSS date in the record is later than the publication date, so the EPSS value should be checked against the current source before use.
  • Scores from different CNAs and CVSS versions differ, and this analysis does not resolve that difference.

Frequently asked questions

Is CVE-2026-0700 being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed in-the-wild exploitation appears in the sources consulted. The record does state that a public exploit has been disclosed.

Which versions are affected?

The only version listed in the record is 1.0 of the code-projects Intern Membership Management System. The record does not provide a fixed version.

What should administrators do now?

Restrict access to the admin paths, review database queries for input handling, monitor logs for unusual requests to check_admin.php, and check with the maintainers for an updated release.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.