CVE-2026-108807 Details

A SQL injection vulnerability has been identified in the 'EmployeeRecruitmentSystem' project by krupalshah, specifically in version 1.0 prior to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. The issue resides in the 'source/adminregister.php' file, within the Registration Handler component. The vulnerability allows remote attackers to manipulate the 'email' and 'password' POST parameters, which are directly inserted into an SQL 'INSERT' statement without proper sanitization or use of prepared statements. This flaw enables unauthorized access to the MySQL/MariaDB database, including the ability to read and write data, particularly in the 'admin' table, which holds sensitive information such as plaintext passwords.

To address this vulnerability, it is recommended to use prepared statements with parameter binding to prevent SQL injection. Additionally, the administrator registration process should require authentication and approval from an existing administrator. Input validation for the 'email' and 'password' parameters is also crucial, along with implementing generic error handling that does not disclose database error details.