CVE-2026-116049: krupalshah EmployeeRecruitmentSystem Registration Wizard SQL Injection (CVSS 7.3)

Executive Summary

CVE-2026-116049 is a SQL injection vulnerability in the open-source krupalshah EmployeeRecruitmentSystem PHP project, published to NVD on 2026-10-25 with a CVSS score of 7.3 (High).

The flaw sits in the mysql_query call used by /source/registerform2.php, part of the Registration Wizard component. Manipulating the university/institute-related form arguments lets an attacker alter the SQL statement executed against the backend database.

Technical Details

The project concatenates user-supplied registration form values directly into a query passed to the legacy mysql_query function, without parameterization or escaping. This is the classic pattern behind SQL injection: input intended as data is interpreted as SQL.

Depending on database permissions, a successful injection could allow an attacker to:

• Read candidate and applicant records (names, contact details, qualifications)
• Modify or insert records in the recruitment database
• Extract credentials stored by the application

Note: The NVD description available at publication was truncated. Confirm the exact vulnerable parameter names and any exploit disclosure against the NVD entry before relying on this summary.

Affected Scope

The project is a small, commit-based repository without versioned releases, so the affected range is expressed as a commit hash. Anyone running a deployment of this code at or before that commit should consider it vulnerable. No fixed release has been identified.

Remediation

1. Do not expose this application to the internet until it is fixed
2. Replace string-built queries with prepared statements (PDO or mysqli) throughout /source/
3. Migrate off mysql_* functions, which were removed in PHP 7
4. Use a least-privilege database account so injection cannot reach unrelated tables
5. Place a WAF in front as a stopgap; it does not replace fixing the code

Detection

• Review web server logs for requests to /source/registerform2.php containing SQL metacharacters (', --, UNION, SLEEP()
• Look for database errors in application logs following registration form submissions
• Audit the database for unexpected rows or modified applicant records

References

• NVD — CVE-2026-116049
• OWASP — SQL Injection Prevention Cheat Sheet