CVE-2026-108805: krupalshah EmployeeRecruitmentSystem Login loginprocessing.php mysql_query sql injection
A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysqlquery of the file source/loginprocessing.php of the component Login Handler. This manipulation of the argument email/password causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of krupalshah EmployeeRecruitmentSystem that include the Login Handler at source/loginprocessing.php are exposed, including deployments based on revisions up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. The issue affects products no longer supported by the maintainer.
Does exploitation require an account or user interaction?
No. The attack can be initiated remotely and the supplied vector indicates no privileges or user interaction are required. An attacker manipulates the email or password input handled by the login process.
How can I determine whether my deployment is affected?
Check whether the application contains source/loginprocessing.php and whether its Login Handler passes email or password input to mysql_query. Version-based confirmation may not be possible because the product uses rolling releases and no fixed release details are available.
What should be considered when prioritizing remediation?
Public exploit availability is reported, so exposed login endpoints should be treated as a practical attack surface. The maintainer did not respond to disclosure and the affected product is unsupported, so a maintainer-provided update may not be available.