Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-8493: Intern Membership Management System 1.0: Remote SQL Injection Risk

CVE-2025-8493 · published 1 year ago

Summary

A critical vulnerability in Intern Membership Management System 1.0 allows attackers to execute unauthorized SQL commands, potentially stealing sensitive data or disrupting the system. This risk affects administrators who use the edit student query feature. Update the system to the latest version to protect against exploitation.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
carmelo	intern_membership_management_system	1.0 `cpe:2.3:a:carmelo:intern_membership_management_system:1.0:::::::*`

Original advisory text

A vulnerability classified as critical was found in code-projects Intern Membership Management System 1.0. This vulnerability affects unknown code of the file /admin/edit_student_query.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

References

https://code-projects.org/ Product
https://vuldb.com/?ctiid.318592 VDB Entry
https://vuldb.com/?id.318592 VDB Entry
https://vuldb.com/?submit.626716 VDB Entry
https://www.yuque.com/gongzi-jsnek/xb2q3a/dpgm5r79h1o8mp1b?singleDoc Exploit Third Party Advisory
https://www.yuque.com/gongzi-jsnek/xb2q3a/dpgm5r79h1o8mp1b?singleDoc# Exploit Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-74Injection

CWE-89SQL Injection

Timeline

Published2 Aug 2025

Updated3 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-8493 · NVD

Track software like this

Free during beta