CVE-2026-108806 Details

A SQL injection vulnerability has been identified in the 'EmployeeRecruitmentSystem' project by krupalshah, specifically in version 1.0 prior to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. The issue resides in the 'source/authprocessing.php' file, within the Forgot Password Handler component. The vulnerability arises because the 'fpemail' POST parameter is directly concatenated into a MySQL query without proper sanitization or use of prepared statements. This flaw allows remote, unauthenticated attackers to manipulate the 'fpemail' value, potentially leading to unauthorized access to database information.

To address this vulnerability, use prepared statements and parameter binding to replace the raw 'mysql_query' calls. Validate the 'fpemail' input to ensure it conforms to a proper email format before constructing the query. Remove the 'or die(mysql_error())' error handling in production to prevent leaking database error details. Be mindful of the information disclosure risk from the password recovery process, and minimize database user permissions while regularly auditing other 'mysql_query' endpoints in the application.