CVE-2026-108805: SQL Injection in krupalshah EmployeeRecruitmentSystem

This vulnerability exists in the EmployeeRecruitmentSystem by krupalshah, specifically in the Login Handler component's mysql_query function within source/loginprocessing.php. The vulnerability arises from improper sanitization of the email and password arguments, enabling remote attackers to conduct SQL injection attacks. The product employs continuous delivery with rolling releases, preventing clear identification of affected or patched versions. The vendor was contacted but did not provide any response or patch. The affected product is no longer maintained or supported.

Successful exploitation of this SQL injection vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, no known exploits are reported in the wild. The vulnerability affects unsupported versions, which increases risk due to lack of vendor remediation.

No official fix or patch is available as the vendor has not responded and the product is no longer supported. Users should discontinue use of the affected product or implement compensating controls such as network-level restrictions to prevent access to the vulnerable login processing functionality. Patch status is not yet confirmed—check vendor advisories if any become available.