CVE-2026-108807: krupalshah EmployeeRecruitmentSystem Registration adminregister.php mysql_query sql injection
A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects the function mysqlquery of the file source/adminregister.php of the component Registration Handler. Performing a manipulation results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of krupalshah EmployeeRecruitmentSystem that include the Registration Handler in source/adminregister.php are exposed if they are running code affected up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. The issue only affects products no longer supported by the maintainer.
Does exploitation require authentication or user interaction?
No. The published severity vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
What should be done if a patch is not available?
The maintainer did not respond to disclosure and the affected product is unsupported, so organizations should plan to replace or retire the affected deployment. Until then, restrict remote access to the application and closely review requests to the registration functionality.
How can I determine whether my deployment is affected?
Inspect whether the deployment contains source/adminregister.php and whether its Registration Handler uses mysql_query in the affected code path. Compare the source with commit 922ff6d208278282e7c8e36d70d9ae356adec9fe where possible; release-version comparison is not available because the product uses a rolling release model.