EUVD-2026-109374
GHSA-r3jr-pj27-m854
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public registration page
-
DeliveryInject SQL payload in registration field
-
ExploitBackend concatenates into mysql_query
-
ExecutionQuery logic subverted
-
ImpactRead or modify recruitment database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a reachable deployment of krupalshah EmployeeRecruitmentSystem exposing the registration form at /source/registerform1.php; exploitation is remote and unauthenticated (CVSS PR:N/UI:N) by submitting crafted values in firstname/middlename/lastname/gender/birthdate/state/statespecify/city/cityspecify. The practical limiting factor is not configuration but footprint: this is an unsupported, obscure project with no fixed release available (rolling release, vendor non-responsive), so exposure depends entirely on an organization self-hosting this specific abandoned application. |
| Impact | This is a CWE-89 SQL injection in the registration endpoint (/source/registerform1.php) of krupalshah EmployeeRecruitmentSystem, an obscure open-source PHP project. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) scores only 5.5 (medium) because each impact dimension is rated Low rather than High, yet the access profile is maximally favorable to an attacker: network-reachable, low complexity, no privileges, no user interaction (PR:N indicates unauthenticated). EPSS is not provided in the input, and this CVE is NOT listed in CISA KEV, so there is no_public_exploit confirmation of active exploitation - a public PoC reference exists (a GitHub issue tagged 'exploit'), but it is not verified as working exploit code. The vuln.today decision label is 'this_month', i.e. a moderate priority rather than act_now/emergency. The tension to flag: a classic unauthenticated remote SQLi against a registration form would normally merit a high score, but the scoring party capped impacts at Low (VC:L/VI:L/VA:L) - possibly reflecting limited data exposure or query context - and this depresses the overall rating. Net: real but low-priority risk, driven primarily by the product being an obscure, unsupported hobby project with negligible deployment, not by scoring doubt about the injection itself. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker submits the public registration form at /source/registerform1.php, placing SQL metacharacters into one of the registration fields (firstname, middlename, lastname, gender, birthdate, state, statespecify, city, or cityspecify), which is concatenated into a mysql_query call. This lets the attacker tamper with the backend query to read or alter recruitment database contents. A public PoC reference exists (a GitHub issue), but it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 25, 2026
SQL injection in the registration endpoint (/source/registerform1.php) of krupalshah EmployeeRecruitmentSystem lets remote, unauthenticated attackers inject arbitrary SQL through the firstname, middlename, lastname, gender, birthdate, state, statespecify, city and cityspecify parameters, with low confidentiality, integrity and availability impact per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The project ships as a rolling release with no version identifiers, the maintainer was contacted and did not respond, and the codebase is no longer supported, so there is no fixed build to upgrade to. A public PoC reference exists in a GitHub issue tracker; it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing) - the practical constraint on this CVE is footprint, not exploitability, and it is triaged for handling this month.
RemediationAI
No vendor-released patch or fixed version exists: the project is a rolling release with no version identifiers, the maintainer was contacted and did not respond, and the code is no longer maintained, so there is nothing to upgrade to. The durable fix is to retire or replace the application with a supported recruitment platform, or, if the registration handler is not needed, remove /source/registerform1.php and its associated registration component entirely. Where the application must stay online in the interim, restrict reachability of the registration endpoint to trusted networks or a reverse-proxy allowlist - accepting that this blocks legitimate remote applicants and is a network-level workaround, not a repair of the underlying query construction; note also that because the code calls the removed mysql_query() API, moving it to a modern PHP runtime is itself likely to break the application rather than secure it. Because the code is abandoned, no upstream commit or pull request should be expected to appear for this issue, and monitoring should focus on whether a host is serving this path at all.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code is a PHP recruitment application that reaches the database through the legacy mysql_query() API from the ext/mysql extension. CWE-89 (SQL injection) arises because the registration handler at /source/registerform1.php passes user-controlled form values (firstname, middlename, lastname, gender, birthdate, state, statespecify, city, cityspecify) into query construction without parameterization or escaping, so attacker-supplied strings alter the query's structure rather than remaining data. The use of mysql_query() implies a legacy PHP 5.x-era runtime, since the mysql_* functions were deprecated in PHP 5.5 and removed in PHP 7.0; deployments are therefore likely to be running outdated, unsupported interpreters alongside the unsupported application, which widens exposure beyond this single flaw. The CPE entry cpe:2.3:a:krupalshah:employeerecruitmentsystem:*:*:*:*:*:*:*:* uses a wildcard version because the project is distributed as a rolling release with no tagged versions; the exact commit referenced in the disclosure (922ff6d208278282e7c8e36d70d9ae356adec9fe) is the only version marker available. The specific query paths and whether error-based, boolean-based or UNION-based retrieval is achievable from each of the nine parameters are not described in the available sources.
Know when Employeerecruitmentsystem gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Unauthenticated network-reachable SQLi via the registration form gives AV:N/AC:L/PR:N/UI:N; impacts kept Low across C/I/A to stay consistent with the scoring party's VC:L/VI:L/VA:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file /source/registerform1.php of the component Registration. Performing a manipulation of the argument firstname/middlename/lastname/gender/birthdate/state/statespecify/city/cityspecify results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Employeerecruitmentsystem
View allUnauthenticated SQL injection in the krupalshah EmployeeRecruitmentSystem admin registration handler (source/adminregist
SQL injection in krupalshah EmployeeRecruitmentSystem (commit 922ff6d and earlier) allows remote unauthenticated attacke
Unauthenticated SQL injection in the Registration Wizard of krupalshah EmployeeRecruitmentSystem (PHP file /source/regis
Exploit-DB