{"id":"CVE-2026-116048","kind":"vulnerability","aliases":["CVE-2026-116048"],"related":[],"title":"EmployeeRecruitmentSystem: registration form SQL injection allows remote database access","description":"A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file /source/registerform1.php of the component Registration. Performing a manipulation of the argument firstname/middlename/lastname/gender/birthdate/state/statespecify/city/cityspecify results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","summary":"Unauthenticated SQL injection in the registration form (source/registerform1.php) of the abandoned krupalshah EmployeeRecruitmentSystem PHP app. A public exploit exists; no patch will come. VulDB rates it CVSS 4.0 5.5.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EmployeeRecruitmentSystem","fixed":[],"affected":"<= 922ff6d208278282e7c8e36d70d9ae356adec9fe","ecosystem":"github"}],"ecosystems":[],"tags":["mysql","package","php","self-hosted","sql-injection","unsupported"],"not_affected_if":["different-codebase","not-deployed"],"how_to_check":"Check whether the deployed app contains source/registerform1.php that builds mysql_query() strings from POST fields (firstname, middlename, lastname, gender, birthdate, state, statespecify, city, cityspecify). Any copy of krupalshah/EmployeeRecruitmentSystem at commit 922ff6d208278282e7c8e36d70d9ae356adec9fe or earlier is affected; no later commits are known.","fix":"No fix exists; project is unmaintained (README: 'no longer maintained'). Stop using it, or rewrite registerform1.php with prepared statements (mysqli/PDO) and restrict access.","status":"open","published_at":"2026-10-25T08:16:26+00:00","first_seen_at":"2026-10-25T08:39:36+00:00","triaged_at":"2026-10-25T08:39:49+00:00","updated_at":"2026-10-25T08:41:18+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T08:39:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"EmployeeRecruitmentSystem: registration form SQL injection allows remote database access","impact":"high","summary":"The registration form in krupalshah EmployeeRecruitmentSystem passes several user-supplied fields (firstname, lastname, city and others) into a MySQL query without sanitizing them. A remote attacker can inject SQL to read or alter the application's database.","category":"package","nicknames":[],"who_cares":["php","mysql","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads or modifies the application database remotely","analyst_note":"No patched version exists and the project is unsupported; confirm whether any fork is maintained and check the NVD entry for the exact affected setup.","how_to_check":"- Look for `/source/registerform1.php` in the deployed application and check whether it builds `mysql_query` calls from request fields without parameterization\n- Confirm whether the instance is running a copy of the repository from commit `922ff6d208278282e7c8e36d70d9ae356adec9fe` or earlier (version details: unknown)","needs_analyst":true,"not_affected_if":["not-deployed","different-codebase"],"who_is_affected":"Anyone running this EmployeeRecruitmentSystem code with the registration form reachable over the network is exposed, since the flaw is in the public registration path and needs no account. The sources say the project is rolling release with no version details and the maintainer no longer supports it, so there is no vendor patch to apply. Teams that do not run this repository can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000637,"input_tokens":3499,"output_tokens":575,"severity_before":"high"},"analyst_status":"done","analyst_note":"No patched version exists and the project is unsupported; confirm whether any fork is maintained and check the NVD entry for the exact affected setup.","search":"'-116048':12A,15A '-2026':11A,14A '/source/registerform1.php':78C '4.0':54B '5.5':55B '922ff6d208278282e7c8e36d70d9ae356adec9fe':65C 'abandon':37B 'access':9A 'affect':66C,127C,151C 'allow':6A 'app':41B 'argument':88C 'attack':100C 'avail':132C 'come':49B 'compon':81C 'contact':136C 'contini':120C 'cve':10A,13A 'cvss':53B 'databas':8A 'deliveri':121C 'detail':125C 'detect':59C 'disclosur':140C 'earli':137C 'employeerecruitmentsystem':1A,16A,39B,62C 'exist':45B 'exploit':44B,103C 'file':77C 'firstname/middlename/lastname/gender/birthdate/state/statespecify/city/cityspecify':89C 'form':3A,33B 'function':72C 'host':22B 'initi':98C 'inject':5A,25B,29B,93C 'krupalshah':38B,61C 'longer':156C 'maintain':160C 'manipul':85C 'may':108C 'mysql':17B,73C 'packag':18B 'patch':47B 'perform':83C 'php':19B,40B 'possibl':96C 'product':112C,152C 'provid':119C 'public':43B,106C 'queri':74C 'rate':51B 'registr':2A,32B,82C 'releas':117C,130C 'remot':7A,101C 'respond':144C 'result':90C 'roll':116C 'self':21B 'self-host':20B 'source/registerform1.php':34B 'sql':4A,24B,28B,92C 'sql-inject':23B 'support':157C 'therefor':122C 'unauthent':27B 'unsupport':26B 'updat':129C 'use':110C,114C 'vendor':134C 'version':124C 'vuldb':50B 'vulner':57C,69C,149C 'way':147C","nicknames":[],"mitigations":[],"who_affected":"Anyone running this EmployeeRecruitmentSystem code with the registration form reachable over the network is exposed, since the flaw is in the public registration path and needs no account. The sources say the project is rolling release with no version details and the maintainer no longer supports it, so there is no vendor patch to apply. Teams that do not run this repository can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T08:16:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-116048","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116048","severity":null,"published_at":"2026-10-25T08:16:26+00:00","modified_at":"2026-10-25T08:16:26+00:00","first_seen_at":"2026-10-25T08:39:36+00:00","fetched_at":"2026-10-25T08:39:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116048:821","url":null,"severity":null,"published_at":"2026-10-25T08:41:18+00:00","modified_at":"2026-10-25T08:41:18+00:00","first_seen_at":"2026-10-25T08:41:18+00:00","fetched_at":"2026-10-25T08:41:18+00:00","note":"Read NVD + VulDB + repo README: unsupported, rolling release, no fix, vendor silent, public exploit (GitHub issue, not fetched). Siblings CVE-2026-116049/116050/108805-7 same product. Forks not checked."}],"documents":[{"id":3447,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116048","title":"NVD CVE-2026-116048","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3448,"url":"https://vuldb.com/vuln/426130","title":"VulDB 426130 EmployeeRecruitmentSystem registerform1.php SQLi","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3449,"url":"https://github.com/krupalshah/EmployeeRecruitmentSystem","title":"krupalshah/EmployeeRecruitmentSystem (no longer maintained)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":3450,"url":"https://github.com/ubfbuz3/cve/issues/59","title":"Public report/PoC issue 59","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}