The vulnerability stems from unsanitized processing of the fpemail argument in the Forgot Password handler of EmployeeRecruitmentSystem, allowing an attacker to craft SQL statements via the mysql_query function. The flaw can be leveraged to execute arbitrary SQL commands, leading to potential data disclosure, modification, or deletion within the system’s database.

All installations of krupalshah EmployeeRecruitmentSystem that incorporate the authprocessing.php component prior to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe are affected. The product does not provide formal versioning, and the vendor has issued no statement about unsupported releases, making every deployed instance susceptible if the commit remains in use.

With a CVSS score of 6.9, the flaw offers moderate but significant risk. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attackers can remotely exploit the flaw by submitting a crafted email address via the Forgot Password form. Public disclosure means the exploitation code is accessible, increasing the likelihood that a malicious actor could execute the injection successfully without authentication.