The vulnerability exposes an unfiltered mysql_query call within the adminregister.php file of EmployeeRecruitmentSystem, allowing an actor to inject arbitrary SQL code. This flaw permits the attacker to read, modify, or delete records in the underlying database, potentially compromising sensitive employee, hiring, or system configuration data. The impact is limited only to the database accessed by the vulnerable application and does not automatically grant system‑level execution, but the information exposure can be extensive.

EmployeeRecruitmentSystem by krupalshah versions up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. The application uses a rolling release model, so newer builds may still contain the vulnerable code if the maintainer has not yet addressed it; the flaw is present only in releases that are no longer supported by the vendor.

The CVSS score of 6.9 reflects a moderate risk level. The EPSS score is not available, so the current exploitation probability is unknown; however, a public exploit has been disclosed, indicating that attackers are actively targeting this vulnerability. The flaw is not listed in the CISA KEV catalog. The description states that the attacker can initiate the attack remotely through the registration interface, so the likely attack vector is a remote web request to the vulnerable endpoint.