krupalshah Employee Recruitment System: SQL Injection (CVE-2026-116050)
The krupalshah Employee Recruitment System contains a SQL injection vulnerability in the registration component, allowing remote attackers to manipulate database queries via the pemail parameter.
CVE search metadata
CVE search record: CVE-2026-116050. Severity: high. CVSS: 7.3. KEV: no. Product: Employee Recruitment System (<= 922ff6d208278282e7c8e36d70d9ae356adec9fe). Brief: krupalshah Employee Recruitment System: SQL Injection (CVE-2026-116050). Brief link: https://feed.craftedsignal.io/briefs/2026-10-employee-recruitment-sql-injection/
Triage facts
Revision 1- Applicability
- Employee Recruitment System (<= 922ff6d208278282e7c8e36d70d9ae356adec9fe)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 25, 12:28 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
A SQL injection vulnerability exists in the Registration component of the krupalshah Employee Recruitment System, specifically within the '/source/registerform3.php' file. The vulnerability is triggered by manipulating the 'pemail' argument. The exploit code is publicly disclosed. As the product uses a rolling release model and is currently unmaintained, there are no patches available. This vulnerability affects all versions up to the commit hash 922ff6d208278282e7c8e36d70d9ae356adec9fe.
Impact
Successful exploitation allows remote attackers to perform unauthorized database queries, potentially leading to data exfiltration or manipulation.
Recommendation
- Inventory all instances of the krupalshah Employee Recruitment System within the environment.
- Since no patch is available, implement web application firewall (WAF) rules to inspect and block requests to '/source/registerform3.php' containing SQL syntax characters (e.g., single quotes, comments, union statements) within the 'pemail' parameter.
- Evaluate the decommissioning of this unmaintained software as it no longer receives security updates.
Immediate actions
Deploy WAF rules to block SQL injection patterns in the pemail parameter for the identified vulnerable application.
Threat Hunt
Inspect web server access logs for requests to /source/registerform3.php containing SQL injection payloads in the pemail parameter.
Data: Web server access logs
Mitigations
Decommission or isolate the krupalshah Employee Recruitment System due to lack of vendor support and publicly available exploit code.
CVE-2026-116050