Technical impact
The vulnerability resides in the registerform2.php component of krupalshah EmployeeRecruitmentSystem, where unsanitized user data is passed directly to mysql_query. An attacker can manipulate the university, institute, branch, degree, status, cpi, semester, and experience parameters to inject arbitrary SQL, potentially allowing data exfiltration, modification, or privilege escalation. The flaw can be triggered remotely and has been publicly disclosed, indicating that exploitation is feasible in a real environment.
Affected Systems
All releases of krupalshah EmployeeRecruitmentSystem up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe are impacted. The system follows a rolling‑release model, so any unsupported release lacking the fix remains vulnerable. The specific component affected is the Registration Wizard module housed in registerform2.php.
Risk and Exploitability
The CVSS score of 6.9 marks this as a medium‑severity issue. Although EPSS data is unavailable and it is not listed in the CISA KEV catalog, the remote nature of the attack and publicly documented exploit increase the likelihood of active exploitation. Until a vendor patch is deployed, the risk persists for any Web‑exposed instance of the affected application.
