CVE-2026-108805 Details

A SQL injection vulnerability has been identified in the 'EmployeeRecruitmentSystem' project by krupalshah, specifically in version 1.0 prior to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. The issue resides in the 'source/loginprocessing.php' file within the Login Handler component. The vulnerability arises because the application directly concatenates the POST parameters 'email' and 'password' into two MySQL queries using the unparameterized 'mysql_query' function. This flaw allows remote attackers to manipulate the queries, bypass authentication, and access the entire database. The vulnerable code leaks detailed database error messages, which can be exploited to extract sensitive information.

To address this vulnerability, it is recommended to use prepared statements with parameter binding to prevent SQL injection. Input validation and filtering should be implemented to ensure user input conforms to expected formats. Additionally, database error messages should not be leaked to the client, and stored passwords should be hashed and salted. Finally, regular security audits should be conducted to identify and fix potential vulnerabilities.