CVE-2026-122038: krupalshah EmployeeRecruitmentSystem Requirement Board Update reqformprocessing.php mysql_query sql injection
A vulnerability was identified in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysqlquery of the file source/reqformprocessing.php of the component Requirement Board Update Handler. Such manipulation leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Deployments of krupalshah EmployeeRecruitmentSystem containing the affected Requirement Board Update Handler are exposed. The issue affects products that are no longer supported by the maintainer; release-level affected or unaffected status cannot be determined because the product does not use versioning.
What does an attacker need to exploit it?
The attack can be launched remotely and requires no privileges or user interaction according to the supplied vector. Public exploit code is available, which may increase the likelihood of exploitation.
How can I determine whether my deployment is affected?
Check whether the application includes source/reqformprocessing.php and uses its Requirement Board Update Handler with the mysql_query function. The supplied information identifies affected code up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe, but does not provide a fixed release or a known-good version.