Cyber Resilience

CVE-2026-0697

MediumPublic PoC

Published: 08 January 2026

Published
08 January 2026
Modified
09 January 2026
KEV Added
—
Patch
—
CVSS Score v4 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0002 5.1th percentile
Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-0697 is a medium-severity Injection (CWE-74) vulnerability in Carmelo Intern Membership Management System. Its CVSS base score is 5.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).

Deeper analysis

CVE-2026-0697 is a SQL injection vulnerability (CWE-74, CWE-89) in code-projects Intern Membership Management System 1.0. The flaw resides in an unknown function within the file /intern/admin/edit_admin.php, where manipulation of the admin_id argument triggers the injection. Published on 2026-01-08, it carries a CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).

The vulnerability enables remote exploitation by attackers possessing high privileges, such as authenticated administrators. With low attack complexity and no need for user interaction, exploitation allows limited impacts: partial disclosure of sensitive data (low confidentiality), minor modification of data or behavior (low integrity), and minor denial of service (low availability). An exploit has been publicly released and is available for use.

Advisories from VulDB (ctiid.339974, id.339974) and related submissions document the issue, alongside a GitHub repository detailing the exploit in Intern Membership Management System admin.php. The code-projects.org page serves as the software source. No patches or specific mitigations are outlined in the provided disclosure details.

EU & UK References

Vulnerability details

A flaw has been found in code-projects Intern Membership Management System 1.0. The impacted element is an unknown function of the file /intern/admin/edit_admin.php. This manipulation of the argument admin_id causes sql injection. The attack may be initiated remotely. The exploit…

more

has been published and may be used.

CWE(s)
CWE-74CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in remotely accessible web admin interface directly enables exploitation of public-facing application (T1190) and unauthorized database queries (T1213.006).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-0850Same product: Carmelo Intern Membership Management System
CVE-2026-0698Same product: Carmelo Intern Membership Management System
CVE-2026-0701Same product: Carmelo Intern Membership Management System
CVE-2026-0699Same product: Carmelo Intern Membership Management System
CVE-2026-0728Same product: Carmelo Intern Membership Management System
CVE-2026-0700Same product: Carmelo Intern Membership Management System
CVE-2026-0729Same product: Carmelo Intern Membership Management System
CVE-2026-3736Same vendor: Carmelo
CVE-2026-4533Same vendor: Carmelo
CVE-2026-5018Same vendor: Carmelo

Affected Assets

carmelo
intern membership management system
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly blocks SQL injection by validating/sanitizing the admin_id argument before it reaches the database query in edit_admin.php.

AC-6 Least Privilege partial match
prevent

Limits the number of users granted the high privileges (PR:H) required to reach and exploit the vulnerable admin_id parameter.

SI-4 System Monitoring partial match
detect

Monitors for anomalous SQL syntax or unexpected database activity originating from the /intern/admin/edit_admin.php endpoint.

References