---
id: "CVE-2026-122038"
kind: "vulnerability"
aliases: ["CVE-2026-122038"]
title: "EmployeeRecruitmentSystem: SQL injection in requirement board form handler"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mysql", "no-fix", "package", "php", "self-hosted", "unsupported"]
not_affected_if: ["different-codebase", "not-deployed"]
published_at: "2026-11-04T23:17:23+00:00"
first_seen_at: "2026-11-05T00:30:59+00:00"
updated_at: "2026-11-05T00:34:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122038", "first_seen_at": "2026-11-05T00:30:59+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122038", "first_seen_at": "2026-11-05T00:34:20+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-122038", "https://github.com/krupalshah/EmployeeRecruitmentSystem"]}]
exploit_sources: []
---

# EmployeeRecruitmentSystem: SQL injection in requirement board form handler

The Requirement Board Update Handler (source/reqformprocessing.php) in the abandoned krupalshah EmployeeRecruitmentSystem builds SQL through mysql_query from request input. A remote attacker can run SQL injection against the recruitment database. NVD says an exploit is public. The project is unmaintained and has no fix.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for source/reqformprocessing.php in your deployed code. If it is there, you run the vulnerable handler.
- Check whether it builds SQL with mysql_query from POST/GET input without escaping.
- There are no versions: every commit up to 922ff6d208278282e7c8e36d70d9ae356adec9fe is affected. The project's other files (registerform1-3, loginprocessing, authprocessing) have similar published SQL injection CVEs, so also check those.

## Fix

No fix. The repository README says the project is no longer maintained, and the NVD entry says the vendor did not respond. There are no version tags, so no fixed release exists. Take it offline, or rewrite the query code in source/reqformprocessing.php to use prepared statements (mysqli or PDO).

## Timeline

- 2026-11-05T00:30:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122038
- 2026-11-05T00:34:20+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-122038 — NVD (CNA VulDB) read; the repo README says unmaintained, no releases, no fork or patch found in search. Exploit is described as public, but I found no PoC link for this specific CVE (siblings exist in ubfbuz3/cve issues), so exploited stays false. Nothing verified: no vendor advisory exists.

## Documents

- [advisory] NVD CVE-2026-122038 https://nvd.nist.gov/vuln/detail/CVE-2026-122038
- [describes] krupalshah/EmployeeRecruitmentSystem README https://github.com/krupalshah/EmployeeRecruitmentSystem

## From the sources

A vulnerability was identified in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/reqformprocessing.php of the component Requirement Board Update Handler. Such manipulation leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_