EmployeeRecruitmentSystem EUVD-2026-97259

Exploitation requires only network reachability of the application's source/adminregister.php endpoint (the Registration Handler); per the CVSS vector PR:N and UI:N, no authentication and no user interaction are needed, so a default-exposed instance is directly attackable. The practical limiting factors are deployment-based rather than technical: the product is an abandoned, unsupported GitHub project with no official release versioning (rolling release up to commit 922ff6d), so exposure depends entirely on an organization having deployed this specific niche application and leaving the admin registration page internet-accessible. No special feature toggle or non-default configuration is documented as a prerequisite.

This is a genuinely low-to-moderate priority issue despite being an unauthenticated network-reachable SQL injection. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates remote, low-complexity exploitation with no privileges or user interaction, which normally signals high risk; however, the impact metrics are all rated Low (VC:L/VI:L/VA:L), yielding a modest base score of 5.5, and the E:P flag confirms only a proof-of-concept rather than mature/weaponized tooling. Publicly available exploit code exists (GitHub issue), raising opportunistic-scanning risk, but there is NO CISA KEV listing and NO EPSS score was provided in the input, so widespread or automated exploitation cannot be asserted - exploitation status is 'publicly available exploit code exists', which is distinct from active exploitation. The strongest risk-reducing factor is prevalence: this is an obscure GitHub-hosted PHP project (krupalshah/EmployeeRecruitmentSystem) that is explicitly no longer supported and whose vendor did not respond to disclosure, so real-world deployment is minimal. Net assessment: a real but low-impact flaw in a rarely deployed, abandoned application - prioritize only if your organization specifically runs this product; otherwise it is a low operational priority.

A remote, unauthenticated attacker sends a crafted HTTP request to source/adminregister.php (the Registration Handler), injecting malicious SQL into a parameter that is passed unsanitized to mysql_query. Because a public proof-of-concept exists, an attacker could reproduce it with minimal effort to read or tamper with database contents such as user or credential records. The low-complexity, no-interaction nature means the request can be automated against any exposed instance.