{"id":"CVE-2026-122038","kind":"vulnerability","aliases":["CVE-2026-122038"],"related":[],"title":"EmployeeRecruitmentSystem: SQL injection in requirement board form handler","description":"A vulnerability was identified in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/reqformprocessing.php of the component Requirement Board Update Handler. Such manipulation leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","summary":"The Requirement Board Update Handler (source/reqformprocessing.php) in the abandoned krupalshah EmployeeRecruitmentSystem builds SQL through mysql_query from request input. A remote attacker can run SQL injection against the recruitment database. NVD says an exploit is public. The project is unmaintained and has no fix.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mysql","no-fix","package","php","self-hosted","unsupported"],"not_affected_if":["different-codebase","not-deployed"],"how_to_check":"- Look for source/reqformprocessing.php in your deployed code. If it is there, you run the vulnerable handler.\n- Check whether it builds SQL with mysql_query from POST/GET input without escaping.\n- There are no versions: every commit up to 922ff6d208278282e7c8e36d70d9ae356adec9fe is affected. The project's other files (registerform1-3, loginprocessing, authprocessing) have similar published SQL injection CVEs, so also check those.","fix":"No fix. The repository README says the project is no longer maintained, and the NVD entry says the vendor did not respond. There are no version tags, so no fixed release exists. Take it offline, or rewrite the query code in source/reqformprocessing.php to use prepared statements (mysqli or PDO).","status":"open","published_at":"2026-11-04T23:17:23+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","triaged_at":"2026-11-05T00:31:55+00:00","updated_at":"2026-11-05T00:34:20+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-05T00:31:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"EmployeeRecruitmentSystem: SQL injection in requirement board form handler","impact":"high","summary":"The Requirement Board Update Handler in source/reqformprocessing.php passes input to mysql_query without sanitizing it, so it is open to SQL injection. An remote attacker can read or change data in the recruitment system's database, and a public exploit exists.","audience":"businesses","category":"package","nicknames":[],"who_cares":["php","self-hosted","mysql"],"confidence":0.6,"fix_status":"none","needs_auth":"no","worst_case":"database contents readable and writable by remote attacker","analyst_note":"Confirm whether the unsupported project has any maintained fork or patch; check the NVD entry for the exploit reference.","how_to_check":"- Look for source/reqformprocessing.php in the deployed EmployeeRecruitmentSystem code\n- Check whether that file builds queries from request input with mysql_query\n- Confirm the project is the krupalshah EmployeeRecruitmentSystem at a commit up to 922ff6d208278282e7c8e36d70d9ae356adec9fe","plain_action":"","needs_analyst":true,"not_affected_if":["not-deployed","different-codebase"],"who_is_affected":"Any deployment of the krupalshah EmployeeRecruitmentSystem that includes source/reqformprocessing.php is exposed, reached over the network by the public form. The project has no versioning and the maintainer no longer supports it, so no fixed release is stated. Teams running it should take it offline or move to a maintained alternative; teams that do not run this project can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4364,"output_tokens":607,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether the unsupported project has any maintained fork or patch; check the NVD entry for the exploit reference.","search":"'-122038':11A,14A '-2026':10A,13A '922ff6d208278282e7c8e36d70d9ae356adec9fe':78C 'abandon':33B 'affect':79C,131C,155C 'attack':46B,106C 'avail':115C 'board':6A,27B,96C 'build':36B 'compon':94C 'contact':140C 'cve':9A,12A 'databas':54B 'disclosur':144C 'earli':141C 'employeerecruitmentsystem':1A,35B,75C 'exploit':58B,112C 'file':90C 'fix':18B,68B 'form':7A 'function':85C 'handler':8A,29B,98C 'host':23B 'identifi':72C 'inform':129C 'inject':3A,50B,104C 'input':43B 'issu':82C 'krupalshah':34B,74C 'launch':109C 'lead':101C 'longer':160C 'maintain':164C 'manipul':100C 'might':117C 'mysql':15B,39B,86C 'no-fix':16B 'nvd':55B 'packag':19B 'php':20B 'product':121C,156C 'project':62B 'public':60B,114C 'queri':40B,87C 'recruit':53B 'releas':134C 'remot':45B,110C 'request':42B 'requir':5A,26B,95C 'respond':148C 'run':48B 'say':56B 'self':22B 'self-host':21B 'source/reqformprocessing.php':30B,91C 'sql':2A,37B,49B,103C 'support':161C 'unaffect':133C 'unavail':136C 'unmaintain':64B 'unsupport':24B 'updat':28B,97C 'use':119C,124C 'vendor':138C 'version':125C 'vulner':70C,153C 'way':151C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of the krupalshah EmployeeRecruitmentSystem that includes source/reqformprocessing.php is exposed, reached over the network by the public form. The project has no versioning and the maintainer no longer supports it, so no fixed release is stated. Teams running it should take it offline or move to a maintained alternative; teams that do not run this project can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","mysql","nofix","package","php","selfhosted","unsupported"],"campaign_type":null,"first_public_at":"2026-11-04T23:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122038","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122038","severity":null,"published_at":"2026-11-04T23:17:23+00:00","modified_at":"2026-11-04T23:17:23+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","fetched_at":"2026-11-05T00:30:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122038:1740","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122038","severity":null,"published_at":"2026-11-05T00:34:20+00:00","modified_at":"2026-11-05T00:34:20+00:00","first_seen_at":"2026-11-05T00:34:20+00:00","fetched_at":"2026-11-05T00:34:20+00:00","note":"NVD (CNA VulDB) read; the repo README says unmaintained, no releases, no fork or patch found in search. Exploit is described as public, but I found no PoC link for this specific CVE (siblings exist in ubfbuz3/cve issues), so exploited stays false. Nothing verified: no vendor advisory exists.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-122038","https://github.com/krupalshah/EmployeeRecruitmentSystem"]}],"documents":[{"id":71622,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122038","title":"NVD CVE-2026-122038","kind":"advisory","source":"analyst","publisher":null,"text":"A vulnerability was identified in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. mysql_query in source/reqformprocessing.php (Requirement Board Update Handler) leads to SQL injection, remotely. Exploit publicly available. No versioning. Vendor did not respond. Only affects products no longer supported by the maintainer.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3449,"url":"https://github.com/krupalshah/EmployeeRecruitmentSystem","title":"krupalshah/EmployeeRecruitmentSystem README","kind":"vendor","source":"analyst","publisher":null,"text":"README: 'This project is no longer maintained.' University mini project, PHP/MySQL, master branch, 15 forks, no releases.","published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}