CVE-2026-116050 Details

A SQL injection vulnerability has been identified in the krupalshah Employee Recruitment System, specifically in the Registration component's '/source/registerform3.php' file, affecting versions up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. The vulnerability arises from the direct concatenation of unvalidated POST parameters into an SQL 'INSERT' statement, without any sanitization or use of prepared statements. This flaw allows remote, unauthenticated attackers to manipulate the 'pemail' parameter, injecting arbitrary SQL and exploiting the application to read and write data in the underlying MySQL/MariaDB database. The issue is exacerbated by the application's lack of error handling, which could otherwise mitigate the exploitation risk.

To address this vulnerability, it is recommended to use prepared statements with parameter binding for all SQL queries, validate email parameters against a strength policy, implement generic error handling to avoid disclosing database error details, add CSRF tokens and rate-limiting to the registration endpoint, and minimize database user permissions while regularly auditing other 'mysql_query' endpoints.