CVE-2026-14700: SQL Injection in Internship Management System
| Field | Value |
|---|---|
| CVE ID | CVE-2026-14700 |
| CVSS score | 7.3 (High) |
| Attack vector | Remote |
| Auth required | Not stated; login endpoint exposure implies no prior authenticated session should be assumed |
| Patch status | No confirmed vendor patch or fixed version identified from retrieved primary references |
TL;DR - CVE-2026-14700 is a remote SQL injection in
employer/login.phpof code-projects Internship Management System 1.0. - Public exploit disclosure is indicated, but in-the-wild exploitation is not confirmed. - If you run version 1.0, treat it as exposed now and mitigate immediately.
Vulnerability at a Glance
CVE-2026-14700 is described by NVD as a SQL injection flaw in code-projects Internship Management System 1.0, specifically in the Employer Login Endpoint at employer/login.php. The vulnerable inputs are identified as the email and password arguments. The practical implication is straightforward: a remote attacker may be able to manipulate backend SQL queries during the login flow.
The most important operational fact is that the only explicitly confirmed affected version is “1.0”. A broader version range has not been established from the available primary references, and a fixed version number has not been identified. That means defenders should avoid assuming the issue is limited to a narrow packaging variant or that an upstream update already exists unless they independently verify it from a vendor advisory or source repository.
What This Vulnerability Is and Why It Matters
SQL injection in a login endpoint is rarely just a nuisance bug. Even when initial reporting only mentions authentication-related parameters, SQL injection can often lead to authentication bypass, credential exposure, database enumeration, or broader data compromise depending on how the query is constructed and what permissions the application database account holds.
In this case, the NVD description says the manipulation of the email/password arguments in employer/login.php leads to SQL injection and that remote exploitation is possible. That combination should matter to practitioners because the vulnerable surface is likely internet-reachable in many deployments and can be probed without prior access. For SMBs and academic environments that deploy sample or low-cost PHP applications with weak monitoring, exploitation attempts may go unnoticed unless web and database logs are being actively reviewed.
Technical Notes
A representative insecure PHP login pattern often looks like this:
<?php
$email = $_POST['email'];
$password = $_POST['password'];
$sql = "SELECT * FROM employers WHERE email = '$email' AND password = '$password'";
$result = mysqli_query($conn, $sql);
?>
If input is concatenated directly into SQL, attacker-controlled values can alter the query logic. Defenders should review employer/login.php and any included authentication helpers for patterns like string-built SQL statements, lack of parameter binding, or direct use of $_POST values in database calls.
Affected Products and Version Details
Based on the retrieved CVE information, the confirmed affected product is:
| Product | Confirmed affected version(s) | Fixed version |
|---|---|---|
| code-projects Internship Management System | 1.0 | Unknown; not identified from retrieved primary references |
It is important to be precise here. The available record confirms “Internship Management System 1.0” as affected. It does not confirm whether versions earlier than 1.0, later than 1.0, forks, repackaged ZIPs, or locally modified deployments are affected. If your organization downloaded this application from a code-sharing site and made local changes, you should assume your instance may still be vulnerable until code review proves otherwise.
Because no authoritative fixed version number was found in the vendor reference or in the retrieved GitHub reference content, defenders should not tell stakeholders that an upgrade path is available unless they have validated one. In the absence of patch data, the safest assumption is that all deployments of Internship Management System 1.0 remain exposed unless locally remediated.
CVSS Score and Risk Interpretation
The reported CVSS base score is 7.3, which places this issue in the High severity range. The exact vector string was not provided in the retrieved NVD tool output, so practitioners should avoid overstating specific sub-metrics such as attack complexity or confidentiality impact beyond what is supported by the source record.
Even without the full vector, the available facts support a practical risk rating higher than many routine web app findings. The flaw is remote, affects a login endpoint, and has public exploit disclosure. Those three points together typically increase the chance that scanners, opportunistic attackers, or students and researchers will test for it quickly after publication. If the application is public-facing and stores applicant, employer, or administrative data, the business impact may exceed what the base score alone suggests.
Exploitation Status
The current evidence supports this clear statement: public exploit disclosure exists, but active exploitation in the wild is not confirmed. NVD states that “The exploit has been disclosed publicly and may be used.” In addition, the CVE references include a GitHub-hosted write-up, which supports the conclusion that exploitation details are publicly available in some form.
At the same time, CISA KEV status is false, meaning the CVE is not currently listed in the Known Exploited Vulnerabilities catalog. That does not mean the bug is safe to defer. It only means there is no CISA KEV confirmation to cite. For defenders, the right assumption is: a usable PoC likely exists, and internet-facing instances should be treated as high-priority even without proof of broad exploitation.
What Defenders Should Do Next
If you inventory vulnerable web applications, add code-projects Internship Management System 1.0 to your review list immediately. Confirm whether the application is deployed anywhere internally or externally, and pay particular attention to lab systems, internship portals, student project environments, and small departmental web servers that may not be in standard asset management.
Then prioritize three actions: contain exposure, inspect employer/login.php, and review logs for attempts against the employer login endpoint. If suspicious requests are found, assume credential and database exposure are possible and expand the investigation to database contents, newly created admin accounts, session logs, and any signs of web shell placement or lateral movement from the web host.
For further information on SQL injection vulnerabilities, consider visiting our SQL Injection Detection Guide and our CVE Glossary.
How to Detect Exploitation Attempts
Detection should focus on the vulnerable path, suspicious input into email and password, and downstream database errors or anomalous login success patterns. Because the vulnerable component is specifically named as employer/login.php, start by isolating requests to that URI in web logs and reviewing both successful and failed authentication events around it.
You should also look for signs of classic SQL injection payloads in HTTP POST bodies, query strings if the app logs them, WAF telemetry, reverse proxy logs, and database error logs. Since the precise exploit payload from the public reference could not be authoritatively extracted from the retrieved content, defenders should use broad SQLi heuristics instead of relying on one signature.
Technical Notes
Example web log indicators for requests targeting the known endpoint:
POST /employer/login.php HTTP/1.1
email=' OR '1'='1
password=' OR '1'='1
Common SQLi patterns to search for in HTTP logs or WAF events:
' OR '1'='1
" OR "1"="1
'--
' #
UNION SELECT
SLEEP(
BENCHMARK(
information_schema
Example Splunk search for suspicious requests to the affected endpoint:
index=web sourcetype=access_combined ("POST /employer/login.php" OR "/employer/login.php")
| regex _raw="(?i)(union\s+select|or\s+['"]?1['"]?=['"]?1|--|#|sleep\s*\(|benchmark\s*\(|information_schema)"
| stats count by src_ip, http_status, uri_path, user_agent
Example grep pattern for Apache or Nginx logs:
grep -Ei "employer/login\.php.*(union select|or ['"]?1['"]?=['"]?1|--|#|sleep\(|benchmark\(|information_schema)" /var/log/nginx/access.log /var/log/apache2/access.log
Database-side signs may include syntax errors near quotes, comment tokens, or unexpected login query failures. If general query logging is enabled in MySQL or MariaDB, review statements originating from the web app user around login bursts or suspicious IP activity.
Mitigation and Patching
The biggest challenge with CVE-2026-14700 is that no confirmed fixed version is currently identified from the retrieved primary references. So, while many CVE explainers simply say “upgrade now,” that would be inaccurate here. If you are running Internship Management System 1.0, the defensive posture should be: there is no verified upstream patch information available, so apply compensating controls and local code fixes immediately.
First, if the application is internet-facing, restrict exposure to trusted IP ranges, VPN users, or an upstream reverse proxy with WAF rules while you assess the code. Second, review employer/login.php and replace any dynamic SQL built from email and password with parameterized queries. Third, if you cannot safely patch the code, disable the employer login functionality or remove the application from public access until remediation is complete. These are blunt measures, but they are appropriate when a public exploit exists and vendor guidance is absent.
Technical Notes
If the application is deployed under Apache, a temporary access restriction can be added while remediation is in progress:
<Location "/employer/login.php">
Require ip 203.0.113.0/24
</Location>
For Nginx, a temporary allowlist approach could look like:
location = /employer/login.php {
allow 203.0.113.0/24;
deny all;
}
If you maintain the PHP code, replace string concatenation with prepared statements. Example using MySQLi:
<?php
$stmt = $conn->prepare("SELECT id FROM employers WHERE email = ? AND password = ?");
$stmt->bind_param("ss", $email, $password);
$stmt->execute();
$result = $stmt->get_result();
?>
If the application is managed from a Git checkout and you have a remediated local branch, an example deployment command sequence may be:
git pull origin main
sudo systemctl reload apache2
If it is a ZIP-style PHP deployment with no package manager, there may be no vendor upgrade command available. In that case, defenders should say so explicitly, document the local fix, and redeploy the corrected file:
sudo cp employer/login.php employer/login.php.bak
sudo install -m 0644 /tmp/remediated-login.php /var/www/html/employer/login.php
sudo systemctl reload nginx
Absent an official fixed release, do not claim a version like “1.0.1” or “2.0” is safe unless you have direct evidence from the maintainer.
References
The authoritative and supporting references available from the research note are limited, so the safest approach is to cite them narrowly and avoid claims they do not support. The NVD description is the clearest source for the affected component, version, and public exploit-disclosure status.
- NVD CVE record: CVE-2026-14700
- CISA KEV status: Not listed
- code-projects site: https://code-projects.org/
- GitHub reference listed by NVD: https://github.com/zzzxc643/CVE1/blob/main/assessment/vul7.md
- Additional reference listings:
- https://vuldb.com/cve/CVE-2026-14700
- https://vuldb.com/submit/846889
- https://vuldb.com/vuln/376296
At the time of writing, the defensible bottom line is simple: CVE-2026-14700 affects code-projects Internship Management System 1.0, is remotely exploitable through employer/login.php, has public exploit disclosure, and has no confirmed fixed version identified from retrieved primary references.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.