CVE-2026-122038 Details
Description
A vulnerability was identified in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/reqformprocessing.php of the component Requirement Board Update Handler. Such manipulation leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
A SQL injection vulnerability has been identified in the 'EmployeeRecruitmentSystem' project by krupalshah, specifically in version 1.0 prior to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. The issue resides in the 'source/reqformprocessing.php' file, within the Requirement Board Update Handler component. The vulnerability allows remote attackers to inject arbitrary SQL by manipulating POST parameters, including 'postname', 'vacancy', 'reqexperience', 'minsalary', and 'maxsalary'. The injected SQL can be exploited to read and modify the underlying MySQL database, including sensitive information such as candidate emails and plaintext passwords.
To address this vulnerability, it is recommended to use prepared statements and parameter binding to prevent SQL injection. Input validation should also be implemented to ensure that 'postname' and other numeric fields are properly sanitized before being used in database queries. Additionally, the application should verify ownership or role before allowing updates to requirement statistics.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Rin471/CVE-/issues/1 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/cve/CVE-2026-122038 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1025067 | [email protected] | Permission Required |
| https://vuldb.com/vuln/431103 | [email protected] | Permission Required |
| https://vuldb.com/vuln/431103/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| krupalshah EmployeeRecruitmentSystem | V1.0 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |