SQL Injection in Internship Management System

Executive Summary

The CVE-2026-14701 vulnerability is a Time-Based Blind SQL Injection found in the Internship Management System's employer password change feature.

An authenticated employer user can exploit this vulnerability by injecting malicious SQL code into the 'current' parameter of the password change endpoint.

The application concatenates untrusted user input directly into the SQL query used to verify the current password without using prepared statements or parameter binding.

This allows an attacker to cause database-side delays (e.g., using a sleep function), which confirms the vulnerability and can lead to database information disclosure, abuse of authentication logic, and compromise of account-related data.

The vulnerable endpoint is POST /employer/myaccount.php?change_password, specifically the 'current' form field, and the flaw is located in the file employer/details/change_password.php.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to disclose sensitive database information by exploiting the SQL injection.

It can also be used to bypass authentication logic, potentially allowing unauthorized access to employer accounts.

Further compromise of account-related data is possible, which could lead to data breaches or unauthorized actions within the system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the password change endpoint for SQL injection in the 'current' parameter. Specifically, an authenticated employer user can send a POST request to /employer/myaccount.php?change_password with a payload that includes SQL syntax designed to induce a delay, such as a sleep function.

A common detection method is to send a payload that causes the server response to be delayed by approximately 10 seconds, indicating a time-based blind SQL injection.

• Use a curl command to send a POST request with a malicious 'current' parameter to test for delay:
• curl -X POST -d "current=' OR IF(SLEEP(10),1,0)-- " https://target/employer/myaccount.php?change_password
• Observe if the response time is significantly delayed (around 10 seconds), which indicates the presence of the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include preventing SQL injection by avoiding direct concatenation of untrusted user input into SQL queries.

Specifically, the application should implement prepared statements or parameterized queries for the password verification process in employer/details/change_password.php.

Additionally, restrict access to the password change endpoint to authenticated users only, and monitor for suspicious activity or unusual delays in responses.

If possible, apply any available patches or updates from the vendor addressing this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated employer user to perform a Time-Based Blind SQL Injection on the password change endpoint, potentially leading to database information disclosure and compromise of account-related data.

Such unauthorized access and data compromise can negatively impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.

Failure to protect user credentials and related data may lead to violations of confidentiality, integrity, and availability requirements mandated by these standards.

Useful 0 Not Useful 0