CVE-2026-108805
Received Received - Intake

SQL Injection in EmployeeRecruitmentSystem

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file source/loginprocessing.php of the component Login Handler. This manipulation of the argument email/password causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108805
EUVD
EUVD-2026-97240

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
krupalshah EmployeeRecruitmentSystem 922ff6d208278282e7c8e36d70d9ae356adec9fe

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108805 is a SQL injection flaw in the EmployeeRecruitmentSystem application. The vulnerability exists in the loginprocessing.php file where user-supplied email and password inputs are directly concatenated into MySQL queries without sanitization. This allows attackers to manipulate these inputs to execute arbitrary SQL commands.

Detection Guidance

To detect this SQL injection vulnerability, check if the EmployeeRecruitmentSystem is running an outdated version with the vulnerable loginprocessing.php file. Use commands like: grep -r 'mysql_query' /path/to/system/source/ to search for vulnerable function calls. Test for SQL injection by sending malformed inputs in email/password fields, such as ' OR '1'='1 in login forms. Monitor database error messages for raw SQL errors.

Impact Analysis

An attacker could remotely exploit this to bypass authentication, gain unauthorized access to any account, extract sensitive data like plaintext passwords, or perform data tampering and deletion. The system's unmaintained status since 2016 increases risk as no patches are available.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized data access, plaintext password storage, and lack of encryption. Non-compliance could result in legal penalties, data breach notifications, and reputational damage for affected organizations.

Mitigation Strategies

Immediately replace mysql_query() with prepared statements using MySQLi or PDO. Implement strict input validation for email/password fields. Remove error leakage by disabling mysql_error() output. Hash stored passwords using password_hash(). Restrict database user permissions to least privilege. Audit other endpoints for similar insecure practices. Consider migrating to a supported system as this product is unmaintained.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108805. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart