CVE-2026-108806: SQL Injection in krupalshah EmployeeRecruitmentSystem

This vulnerability in krupalshah EmployeeRecruitmentSystem up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe involves SQL injection via the fpemail parameter in the Forgot Password Handler, specifically in the mysql_query call within source/authprocessing.php. The vulnerability allows remote attackers to inject SQL commands by manipulating the fpemail argument. The product does not use versioning, making it impossible to specify affected versions precisely. The vendor was contacted but did not respond, and the product is no longer maintained.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the backend database with low complexity and no privileges required. This can lead to data leakage, modification, or deletion depending on the database permissions. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). There is no indication of active exploitation in the wild.

No official patch or fix is available as the product is no longer supported and the vendor did not respond to disclosure. Users should consider discontinuing use of this software or implementing external mitigations such as web application firewalls to detect and block SQL injection attempts. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance if it becomes available.