Description

A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file source/loginprocessing.php of the component Login Handler. This manipulation of the argument email/password causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-12T06:16:59.687Z",
  "pubdate": "2026-10-12T06:16:59.687Z",
  "executiveSummary": "A critical SQL injection vulnerability exists within the krupalshah EmployeeRecruitmentSystem, specifically affecting the authentication mechanism handled by source/loginprocessing.php.\nThe vulnerability arises from the insecure handling of user-supplied input within the mysql_query function, allowing an attacker to manipulate backend database queries.\nThe flaw is remotely exploitable, requiring no prior authentication, and allows unauthorized parties to bypass security controls or execute arbitrary database commands.\nGiven that the project is no longer maintained and no patches are available, the risk to instances of this software is high.\nThe potential impact includes unauthorized data exfiltration, authentication bypass, and total compromise of the database integrity associated with the recruitment system.\nThis vulnerability is publicly documented with existing exploit code, increasing the likelihood of automated or manual exploitation attempts against exposed systems.",
  "technicalDetails": "The vulnerability is located in source/loginprocessing.php, where the 'email' and 'password' input parameters are processed. The application fails to sanitize or parameterize these inputs before passing them directly to the mysql_query function.\nThe root cause is the lack of prepared statements or proper input validation, which enables an attacker to inject arbitrary SQL syntax into the query structure. By manipulating the input strings, an attacker can alter the logic of the authentication query, effectively causing it to return a 'true' evaluation regardless of the actual credentials provided.\nThe attack flow initiates with a remote request to the login endpoint. An attacker crafts a payload containing SQL special characters, such as single quotes (') or comment indicators (--), to break out of the intended data field within the SQL statement. For instance, an input like ' OR '1'='1' injected into the email field could bypass the authentication check by forcing the backend database to return the first record in the users table, effectively logging the attacker in as the administrator or a legitimate user.\nBecause the system uses the legacy mysql_query extension, the application is highly susceptible to union-based, error-based, or blind SQL injection techniques. Beyond simple authentication bypass, an attacker can leverage this access to perform data exfiltration (UNION SELECT statements), modify existing recruitment records, or potentially perform administrative actions if the database user permissions are overly permissive.\nThe vulnerability affects all versions of EmployeeRecruitmentSystem up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. Since the vendor has ceased support and the product follows a continuous delivery model without versioned releases, no remediation path exists within the software itself. Exploitation does not require authentication, making it a critical threat to any network-exposed instance of the application."
}