CVE-2026-116050: krupalshah Employee Recruitment System registerform3.php SQL Injection (CVSS 7.3)

Executive Summary

CVE-2026-116050 is a SQL injection vulnerability in the krupalshah Employee Recruitment System, published to NVD on 2026-10-25 with a CVSS score of 7.3 (High). It is a sibling of CVE-2026-116049, disclosed the same day in the same project.

The issue affects /source/registerform3.php in the Registration component. Manipulating the pemail argument leads to SQL injection, and the attack can be launched remotely.

Technical Details

The pemail field submitted during registration is placed into a SQL statement without sanitization or parameter binding. An attacker who sends a crafted value can change the meaning of the query.

Two vulnerabilities in consecutive registration steps (registerform2.php and registerform3.php) suggest the whole registration flow shares the same unsafe query-building pattern, so fixing one file alone is unlikely to be enough.

Potential impact, depending on database privileges:

• Disclosure of applicant and account data
• Tampering with or inserting records
• Authentication bypass if login queries share the pattern

Note: The NVD description available at publication was truncated. Confirm any exploit-disclosure details against the NVD entry.

Remediation

1. Keep the application off the public internet until it is fixed
2. Use prepared statements (PDO or mysqli) for every query in /source/
3. Validate pemail server-side as an email address
4. Restrict database account privileges to the minimum the app needs
5. Review the whole code base for other string-built queries, not just these two files

Detection

• Search access logs for requests to /source/registerform3.php where pemail contains quotes, comment sequences, or SQL keywords
• Check for registration errors or unusually slow responses (possible time-based injection)
• Audit the database for unexpected changes

References

• NVD — CVE-2026-116050
• OWASP — SQL Injection Prevention Cheat Sheet