CVE-2026-108807: SQL Injection in krupalshah EmployeeRecruitmentSystem

This vulnerability exists in the krupalshah EmployeeRecruitmentSystem up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. It affects the mysql_query function in the source/adminregister.php file within the Registration Handler component. An attacker can remotely perform SQL injection by manipulating input that reaches this function. The product follows a rolling release model, so exact version ranges are not specified. The vendor was contacted but did not respond, and no patch or remediation details are available. The vulnerability is publicly known and exploit code has been published, but no known exploits are reported in the wild. The affected product is no longer supported by the maintainer.

Successful exploitation could allow an unauthenticated remote attacker to perform SQL injection attacks, potentially leading to unauthorized data access or modification. The vulnerability has a medium severity score (CVSS 6.9) with low vector and impact complexity, and no privileges or user interaction required. However, the vulnerability is limited to unsupported versions of the product, which may increase risk due to lack of vendor support.

No official patch or remediation is available as the vendor did not respond and the product is no longer supported. Users should discontinue use of the affected product or implement compensating controls such as isolating the vulnerable system from untrusted networks. Monitor for any community-provided patches or updates. Patch status is not yet confirmed — check the vendor advisory or project repository for any updates.