SQL Injection in krupalshah EmployeeRecruitmentSystem

A SQL injection vulnerability exists in the krupalshah EmployeeRecruitmentSystem, specifically affecting all versions up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. The flaw resides in the 'mysql_query' function within 'source/loginprocessing.php', which fails to properly neutralize user-supplied input in the 'email' and 'password' parameters. An unauthenticated remote attacker can exploit this vulnerability to perform unauthorized SQL operations against the underlying database. Because the project utilizes rolling releases and is currently unmaintained, no official patch or versioned update exists. Organizations using this software should transition to an alternative solution, as the repository is effectively abandoned and the vulnerability is subject to public exploitation.

Impact

Successful exploitation allows remote attackers to execute arbitrary SQL queries, which may lead to complete compromise of the recruitment system's database, authentication bypass, or exfiltration of sensitive candidate and employee information. Given the nature of the application, this may include personally identifiable information (PII) or credentials stored within the database. The software is no longer maintained, leaving all existing deployments perpetually vulnerable to this and other potential security flaws.

Recommendation

• Immediately isolate instances of the EmployeeRecruitmentSystem from public network access or decommission the application entirely.
• Implement web application firewall (WAF) rules to inspect POST request bodies to 'source/loginprocessing.php' for common SQL injection patterns, such as single quotes, comment indicators (--), and tautologies (e.g., OR 1=1).
• Review application logs for anomalous POST requests to the login endpoint that contain suspicious string concatenations or unusual character sets indicative of SQL injection attempts.