Description

A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects the function mysql_query of the file source/adminregister.php of the component Registration Handler. Performing a manipulation results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-12T07:16:35.707Z",
  "pubdate": "2026-10-12T07:16:35.707Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the krupalshah EmployeeRecruitmentSystem up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. The flaw originates within the Registration Handler component, specifically inside the source/adminregister.php script. The vulnerability exists due to improper handling of user-supplied input when passing parameters directly into the mysql_query function without sufficient sanitization or query parameterization.\nThis security weakness enables unauthenticated remote attackers to execute arbitrary SQL commands against the backend database. Successful exploitation can lead to severe impacts, including full access to sensitive records, unauthorized data modification, database deletion, and potential system compromise depending on database user privileges. Exploitation requires minimal complexity, no initial privileges, and can be initiated over the network.\nPublic exploit code is available for this vulnerability, increasing the risk of automated scanning and opportunistic exploitation. The vendor was notified regarding the issue but did not respond. Furthermore, because this product follows a rolling release model, specific version numbering is unavailable, and the maintainer no longer actively supports the application. Consequently, official security patches will not be released for affected installations.",
  "technicalDetails": "The root cause of this vulnerability lies in insecure database interaction routines located in the Registration Handler component of krupalshah EmployeeRecruitmentSystem up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. Within source/adminregister.php, user input captured from HTTP request parameters is directly concatenated into SQL statement strings. These concatenated strings are subsequently executed using the legacy PHP database API function mysql_query.\nBecause the application relies on mysql_query without parameter binding or robust input sanitization, structural control characters supplied by an attacker are evaluated directly by the database parser. An adversary can craft malicious HTTP requests containing SQL syntax control sequences, effectively altering the intended logic of the SQL query before execution.\nThe attack flow proceeds remotely without requiring prior authentication or administrative access. An attacker sends a specially crafted payload to the source/adminregister.php endpoint targeting parameters handled during admin registration. When the server processes the incoming request, the unescaped input is embedded directly into the query string passed to mysql_query. The database engine executes the mutated SQL statement, interpreting the embedded attacker payloads as legitimate database commands.\nPost-exploitation consequences depend on the database configuration and the privilege level of the user account connected via mysql_query. Attackers can perform first-order SQL injection to bypass registration logic, extract stored administrative credentials, harvest confidential data, or alter database contents. In environments where the database user possesses elevated system privileges (such as FILE permissions in MySQL), attackers may potentially read arbitrary files or attempt database-assisted remote code execution on the underlying host server.\nGiven that public exploit code is available and the application is distributed via a rolling release mechanism without tagged version releases, all instances operating code up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe remain inherently vulnerable."
}