Technical impact
The vulnerability resides in the registerform1.php file of EmployeeRecruitmentSystem, where the mysql_query function is called with user‑supplied arguments such as firstname, middlename, lastname, and others. By manipulating these parameters, an attacker can inject arbitrary SQL statements, enabling unauthorized read, write, or delete operations on the database. The weakness is classified as CWE‑89 (SQL Injection) and CWE‑74 (improper control of path or database file names), and the impact includes potential disclosure of sensitive employee data, modification of records, or data loss. No evidence of remote code execution is reported, but the ability to alter database contents can lead to significant business disruption.
Affected Systems
The product affected is krupalshah EmployeeRecruitmentSystem, up to the commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. Because the application follows a rolling release model, specific version numbers are not published. Consequently, any deployment that has not migrated beyond that commit is vulnerable. The vulnerability originates from the Registration component in registerform1.php and is remotely exploitable via the registration endpoint.
Risk and Exploitability
The CVSS score of 6.9 indicates moderate severity, and the public exploit is available, although the EPSS score is not reported. The product is not listed in the CISA KEV catalog, suggesting limited large‑scale exploitation to date. Still, the attack vector is remote and does not require privileged access to the web server, making it accessible to any internet‑connected attacker who can submit registration requests. The risk is therefore significant for organizations still running the affected revision and should be addressed promptly.
