Description

A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/authprocessing.php of the component Forgot Password Handler. Such manipulation of the argument fpemail leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-12T06:16:59.877Z",
  "pubdate": "2026-10-12T06:16:59.877Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the krupalshah EmployeeRecruitmentSystem, specifically within the Forgot Password Handler component.\nThe vulnerability originates from improper neutralization of user-supplied data in the 'fpemail' argument, which is passed directly into a 'mysql_query' function call within 'source/authprocessing.php'.\nThis flaw allows remote, unauthenticated attackers to manipulate backend database queries, potentially leading to unauthorized data exfiltration, authentication bypass, or complete database compromise.\nThe product is currently unmaintained, and no vendor patches are available, placing users of any version up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe at significant risk.\nPublic disclosure of exploit code increases the probability of successful exploitation by malicious actors.",
  "technicalDetails": "The vulnerability resides in 'source/authprocessing.php' within the Forgot Password functionality. The application accepts input via the 'fpemail' parameter, which is intended to identify a user account for password recovery procedures.\nThe root cause is a failure to implement parameterized queries or adequate input sanitization before the 'fpemail' argument is concatenated into a SQL statement executed by the 'mysql_query' function.\nBecause the application does not employ prepared statements or utilize escaping functions (e.g., 'mysqli_real_escape_string'), an attacker can inject malicious SQL syntax into the 'fpemail' field.\nThe attack flow begins with the attacker submitting a crafted HTTP POST or GET request containing a malicious payload in the 'fpemail' argument. For example, an attacker could input a string like 'x' OR '1'='1', which alters the structural logic of the intended SQL query.\nBy manipulating the SQL command, the attacker can force the database to return records they are not authorized to view, or execute administrative commands if the database user permissions are overly permissive.\nSince the 'mysql_query' function in PHP (specifically the legacy 'mysql' extension) is deprecated and insecure, it lacks the protective mechanisms found in modern database abstraction layers like PDO or MySQLi with prepared statements.\nThe exploitation is feasible remotely without requiring authentication or specific user privileges, as the Forgot Password function is typically exposed publicly to allow users to reset their credentials.\nPost-exploitation impact may include the unauthorized extraction of user credentials, database schema enumeration, or potential compromise of the underlying web server if the database configuration allows for file system interactions.\nGiven that the affected product is abandoned and lacks versioning, all installations using the identified code are susceptible to this vector."
}