V1.0 (master branch, no version tags; repository marked "This project is no longer maintained" by the original vendor since 2016)
SQL injection (boolean-based blind + error-based + time-based blind + UNION column-enumeration)
A SQL injection vulnerability was found in the 'source/loginprocessing.php' file of the 'EmployeeRecruitmentSystem' project. The reason for this issue is that the application takes the POST parameter 'email' and 'password' and concatenates them directly into two MySQL queries without any sanitisation, prepared statement or escaping. The affected file uses the legacy mysql_query() API together with or die(mysql_error()) , which both confirms the use of unparameterised SQL and leaks the full database error message back to the HTTP response. This allows an unauthenticated remote attacker to forge the 'email' value, thereby manipulating both queries, bypassing the password check and reading the entire database.
The vulnerable code (source/loginprocessing.php, lines 6–16):
Attackers can exploit this SQL injection vulnerability to (a) completely bypass the login authentication and obtain a valid session as any user or administrator without knowing any password (authentication bypass), (b) read the entire database (other users' e-mails and plaintext passwords, admin credentials, candidate profiles, requirements, etc.), (c) read other databases on the same MySQL/MariaDB instance through information_schema , and (d) potentially tamper or delete data, posing a serious threat to system security and business continuity.
During the security review of "EmployeeRecruitmentSystem" I discovered a critical, pre-authentication SQL injection vulnerability in the 'source/loginprocessing.php' file. The vulnerability stems from insufficient validation of the POST parameter 'email' (and 'password'), which is interpolated directly into two unparameterised mysql_query statements that are also wired to die(mysql_error()) , leaking raw database error output to the browser. Because the vulnerable endpoint is the public login handler itself, no account, cookie, or any kind of authorization is required to reach the injection point. An unauthenticated remote attacker can therefore bypass authentication and gain full read access to the underlying MySQL/MariaDB database. Immediate remediation is needed to ensure system security and protect data integrity.
Vulnerability location:
POST parameter 'email' (and 'password') in source/loginprocessing.php — the public login handler, reachable without authentication.
Proof-of-Concept (raw PoC commands, unauthenticated)
sqlmap — full database and table dump (unauthenticated)
The following are screenshots of specific information obtained from testing and running with the sqlmap tool:
Use prepared statements and parameter binding: Preparing statements can prevent SQL injection as they separate SQL code from user input data. When using prepare statements, the value entered by the user is treated as pure data and will not be interpreted as SQL code. Replace the two raw mysql_query calls with mysqli / PDO prepared statements and bind the email / password parameters (the legacy mysql_* API is removed from PHP 7+ and is deprecated even in 5.5).
Use prepared statements and parameter binding: Preparing statements can prevent SQL injection as they separate SQL code from user input data. When using prepare statements, the value entered by the user is treated as pure data and will not be interpreted as SQL code. Replace the two raw mysql_query calls with mysqli / PDO prepared statements and bind the email / password parameters (the legacy mysql_* API is removed from PHP 7+ and is deprecated even in 5.5).
Input validation and filtering: Strictly validate and filter user input data to ensure it conforms to the expected format (e.g. enforce an e-mail pattern and a minimum password length before the query is built).
Input validation and filtering: Strictly validate and filter user input data to ensure it conforms to the expected format (e.g. enforce an e-mail pattern and a minimum password length before the query is built).
Do not leak database errors to the client: Remove the or die(mysql_error()) calls (or gate them behind a debug flag) — leaking raw SQL errors is what makes the error-based technique so cheap and must be turned off in production.
Do not leak database errors to the client: Remove the or die(mysql_error()) calls (or gate them behind a debug flag) — leaking raw SQL errors is what makes the error-based technique so cheap and must be turned off in production.
Hash and salt the stored passwords: The account.password and admin.password columns currently store plaintext passwords (verified by the --dump step above). Migrate to password_hash() / bcrypt so a database leak does not directly expose user credentials.
Hash and salt the stored passwords: The account.password and admin.password columns currently store plaintext passwords (verified by the --dump step above). Migrate to password_hash() / bcrypt so a database leak does not directly expose user credentials.
Minimize database user permissions: Ensure that the account used to connect to the database has the minimum necessary permissions. Avoid using accounts with advanced permissions (such as 'root' or 'admin') for daily operations.
Minimize database user permissions: Ensure that the account used to connect to the database has the minimum necessary permissions. Avoid using accounts with advanced permissions (such as 'root' or 'admin') for daily operations.
Regular security audits: Regularly conduct code and system security audits to promptly identify and fix potential security vulnerabilities. The other endpoints that also call mysql_query with concatenated user input ( authprocessing.php , registerform1/2/3.php , reqformprocessing.php , feedbackprocessing.php , viewaccount.php , viewpersonal.php , viewacademic.php , requirementboard.php ) should be audited and rewritten the same way.
Regular security audits: Regularly conduct code and system security audits to promptly identify and fix potential security vulnerabilities. The other endpoints that also call mysql_query with concatenated user input ( authprocessing.php , registerform1/2/3.php , reqformprocessing.php , feedbackprocessing.php , viewaccount.php , viewpersonal.php , viewacademic.php , requirementboard.php ) should be audited and rewritten the same way.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
