CVE-2026-38567 Details

A SQL injection vulnerability has been identified in HireFlow version 1.2, specifically within the '/login' and '/search' endpoints. The issue arises because user input is directly concatenated into SQL queries without proper parameterization. This flaw allows an unauthenticated attacker to bypass authentication by sending a crafted username, such as 'admin' followed by a comment delimiter. Additionally, the vulnerability can be exploited to extract the entire database, including user credentials, through UNION-based injection at the '/search' endpoint.

The vulnerability has been patched in version 1.3. Users are advised to update to this version. For future development, replace all raw string concatenation in SQL queries with parameterized queries or prepared statements. Alternatively, use an Object-Relational Mapping (ORM) tool like SQLAlchemy, which automatically handles query parameterization.