Online Job Portal EUVD-2026-41704

The application's login.php must be network-accessible to the attacker - no prior authentication or account is required. The CVSS 4.0 vector PR:N/UI:N/AC:L confirms exploitation requires no privileges, no user interaction, and no complex pre-conditions. The vulnerability exists in the default installation of Online Job Portal 1.0 with no special configuration required. Limiting factors include: the application must be actively deployed and reachable over the network (it is not universally deployed); the PHP environment must not independently sanitize POST input (e.g., via a global framework filter, which is not present in this project type); and exploitation depth is bounded by the database account's privilege level - a least-privilege DB user would limit but not eliminate impact.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects the most dangerous access profile - remotely exploitable, low complexity, requiring no authentication or user interaction against a default deployment. The E:P modifier confirms a public exploit exists, consistent with the GitHub POC reference. Despite the CVSS 4.0 base score of 6.9 and limited impact ratings (VC:L/VI:L/VA:L), SQL injection at a login endpoint typically enables full authentication bypass in practice, which may not be fully captured by the partial impact scores. No EPSS data was provided, preventing probabilistic exploitation rate comparison. The product is not listed in the CISA KEV catalog, so confirmed active exploitation in the wild is not established. The real-world risk is largely bounded by the product's narrow deployment footprint - this is a code-projects.org demo/academic PHP application unlikely to appear in enterprise environments - but any exposed instance should be treated as critically compromised-pending given the unauthenticated vector and public POC.

An unauthenticated remote attacker submits a crafted HTTP POST request to login.php with a SQL payload such as ' OR '1'='1' -- in the txtUser field, causing the backend query to evaluate as always-true and bypassing the authentication check entirely. With the public proof-of-concept on GitHub providing exact exploitation steps, even low-skill attackers can replicate the attack against any internet-exposed instance. Depending on the database user's privileges, the attacker may further enumerate tables, extract credential data, or issue destructive queries.