Attack Chain

1. Attacker performs reconnaissance to identify instances of the Online Job Portal System.
2. Attacker navigates to the target web application and identifies the password recovery page (/ForPass.php).
3. Attacker crafts a malicious HTTP GET or POST request containing SQL injection payloads targeting the 'txtUserName' input field.
4. The vulnerable application receives the crafted request and fails to neutralize special characters in the 'txtUserName' parameter.
5. The backend database executes the injected SQL commands.
6. The application returns database results or error messages to the attacker, confirming successful execution.
7. Attacker extracts data from the database or modifies records to gain further unauthorized access.

Impact

Successful exploitation allows remote, unauthenticated attackers to query, modify, or delete data within the database backing the Online Job Portal System. This could lead to the exposure of sensitive user credentials, job applicant personal identifiable information (PII), and administrative account compromises. As of the disclosure date, the impact is considered high (CVSS 7.3), and public exploit availability significantly increases the probability of compromise for exposed instances.

Recommendation

• Deploy WAF rules to inspect HTTP traffic targeting /ForPass.php and sanitize input for the 'txtUserName' parameter, blocking common SQL injection patterns (e.g., OR 1=1, UNION SELECT).
• Implement the provided Sigma rule to detect anomalous requests to the vulnerable endpoint within web server logs.
• Review web server access logs for requests containing suspicious characters or SQL keywords in the 'txtUserName' parameter.
• Upgrade the Online Job Portal System to a secure version if available; if no patch exists, restrict access to the /ForPass.php file via network segmentation or IP allowlisting.