CVE-2026-116049 Details
Description
A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file /source/registerform2.php of the component Registration Wizard. Executing a manipulation of the argument university/institute/branch/degree/status/cpi/semester/experience can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
A SQL injection vulnerability has been identified in the 'EmployeeRecruitmentSystem' project by krupalshah, specifically in version 1.0 up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. The issue resides in the 'source/registerform2.php' file, within the Registration Wizard component. The vulnerability arises because the 'mysql_query' function is used to execute an SQL 'INSERT' statement with eight POST parameters—'university', 'institute', 'branch', 'degree', 'status', 'cpi', 'semester', and 'experience'—directly concatenated into the query without any sanitization or use of prepared statements. This flaw allows remote attackers to manipulate the parameters and inject arbitrary SQL, exploiting the endpoint without authentication.
To address this vulnerability, it is recommended to use prepared statements with parameter binding to replace the raw 'mysql_query' INSERT operations. Additionally, input validation should be implemented for all POST parameters, and generic error handling should be employed to avoid disclosing sensitive error details.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 25, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ubfbuz3/cve/issues/60 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/cve/CVE-2026-116049 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/995468 | [email protected] | Permission Required |
| https://vuldb.com/vuln/426131 | [email protected] | Permission Required |
| https://vuldb.com/vuln/426131/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| krupalshah EmployeeRecruitmentSystem | V1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 25, 2026 | New CVE Received | [email protected] |