| 제목 | https://github.com/krupalshah/EmployeeRecruitmentSystem EmployeeRecruitmentSystem V1.0 (master branch, no version tags; repository marked "This project is no longer maintained" by the original vendor since 2016 /source/loginprocessing.php |
|---|
| 설명 | During the security review of "EmployeeRecruitmentSystem" I discovered a critical, pre-authentication SQL injection vulnerability in the 'source/loginprocessing.php' file. The vulnerability stems from insufficient validation of the POST parameter 'email' (and 'password'), which is interpolated directly into two unparameterised mysql_query statements that are also wired to die(mysql_error()), leaking raw database error output to the browser. Because the vulnerable endpoint is the public login handler itself, no account, cookie, or any kind of authorization is required to reach the injection point. An unauthenticated remote attacker can therefore bypass authentication and gain full read access to the underlying MySQL/MariaDB database. Immediate remediation is needed to ensure system security and protect data integrity. |
|---|
| 원천 | ⚠️ https://github.com/Rin471/CVE-/issues/2 |
|---|
| 사용자 | xinshouyige58 (UID 102073) |
|---|
| 제출 | 2026. 10. 12. AM 05:29 (25 날 ago) |
|---|
| 모더레이션 | 2026. 11. 04. PM 03:47 (23 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 416582 [krupalshah EmployeeRecruitmentSystem 까지 922ff6d208278282e7c8e36d70d9ae356adec9fe Login loginprocessing.php mysql_query email/password SQL 주입] |
|---|
| 포인트들 | 0 |
|---|