---
id: "CVE-2026-116048"
kind: "vulnerability"
aliases: ["CVE-2026-116048"]
title: "EmployeeRecruitmentSystem: registration form SQL injection allows remote database access"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "EmployeeRecruitmentSystem", "fixed": [], "affected": "<= 922ff6d208278282e7c8e36d70d9ae356adec9fe", "ecosystem": "github"}]
ecosystems: []
tags: ["mysql", "package", "php", "self-hosted", "sql-injection", "unsupported"]
not_affected_if: ["different-codebase", "not-deployed"]
published_at: "2026-10-25T08:16:26+00:00"
first_seen_at: "2026-10-25T08:39:36+00:00"
updated_at: "2026-10-25T08:41:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116048", "first_seen_at": "2026-10-25T08:39:36+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T08:41:18+00:00"}]
---

# EmployeeRecruitmentSystem: registration form SQL injection allows remote database access

Unauthenticated SQL injection in the registration form (source/registerform1.php) of the abandoned krupalshah EmployeeRecruitmentSystem PHP app. A public exploit exists; no patch will come. VulDB rates it CVSS 4.0 5.5.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:EmployeeRecruitmentSystem affected <= 922ff6d208278282e7c8e36d70d9ae356adec9fe fixed ?

## How to check

Check whether the deployed app contains source/registerform1.php that builds mysql_query() strings from POST fields (firstname, middlename, lastname, gender, birthdate, state, statespecify, city, cityspecify). Any copy of krupalshah/EmployeeRecruitmentSystem at commit 922ff6d208278282e7c8e36d70d9ae356adec9fe or earlier is affected; no later commits are known.

## Fix

No fix exists; project is unmaintained (README: 'no longer maintained'). Stop using it, or rewrite registerform1.php with prepared statements (mysqli/PDO) and restrict access.

## Timeline

- 2026-10-25T08:39:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116048
- 2026-10-25T08:41:18+00:00 analyst — Read NVD + VulDB + repo README: unsupported, rolling release, no fix, vendor silent, public exploit (GitHub issue, not fetched). Siblings CVE-2026-116049/116050/108805-7 same product. Forks not checked.

## Documents

- [advisory] NVD CVE-2026-116048 https://nvd.nist.gov/vuln/detail/CVE-2026-116048
- [describes] VulDB 426130 EmployeeRecruitmentSystem registerform1.php SQLi https://vuldb.com/vuln/426130
- [mentions] krupalshah/EmployeeRecruitmentSystem (no longer maintained) https://github.com/krupalshah/EmployeeRecruitmentSystem
- [poc] Public report/PoC issue 59 https://github.com/ubfbuz3/cve/issues/59

## From the sources

A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file /source/registerform1.php of the component Registration. Performing a manipulation of the argument firstname/middlename/lastname/gender/birthdate/state/statespecify/city/cityspecify results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_