CVE-2026-116048 Details

A SQL injection vulnerability has been identified in the 'EmployeeRecruitmentSystem' project by krupalshah, specifically in version 1.0 prior to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. The issue resides in the 'source/registerform1.php' file, within the registration component. The vulnerability arises because the 'mysql_query' function is used to execute an 'INSERT' statement without proper sanitization or the use of prepared statements. This flaw allows remote attackers to manipulate several POST parameters, including 'firstname', 'middlename', 'lastname', 'gender', 'birthdate', 'state', 'statespecify', 'city', and 'cityspecify', injecting arbitrary SQL instead. The registration endpoint is accessible without authentication, making it possible for attackers to exploit this vulnerability remotely and extract or modify data in the underlying MySQL or MariaDB database.

To address this vulnerability, use prepared statements with parameter binding to replace the raw 'mysql_query' INSERT operations. Validate all input fields against expected formats before executing queries, and implement generic error handling to avoid disclosing database error details to users.