A flaw in the login handling code of EmployeeRecruitmentSystem allows an attacker to inject arbitrary SQL through the email or password fields. The vulnerable mysql_query call does not escape or parameterize user input, enabling a classic injection that can extract sensitive data or write arbitrary data to the database. Because the login endpoint is exposed over the network, this vulnerability can be triggered remotely by any authenticated or unauthenticated user.

The vulnerability affects all installations of krupalshah EmployeeRecruitmentSystem whose code base is unchanged from or older than commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. No subsequent releases have been identified as patched, and the maintainer has not yet issued a fix. Consequently, only older, unsupported versions remain exposed.

The CVSS score of 6.9 indicates a moderate to high risk, and the exploit is publicly available, suggesting that attackers could deploy it in the wild. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, so the baseline risk estimate remains purely from the CVSS and public exploit availability. Given the remote attack vector and lack of vendor response, this flaw should be considered a significant threat to confidentiality and integrity of the underlying database.