V1.0 (master branch, no version tags; repository marked "This project is no longer maintained" by the original vendor since 2016)
SQL injection (boolean-based blind + error-based + time-based blind + UNION query)
A SQL injection vulnerability was found in the 'source/authprocessing.php' file (the "forgot password" / account-recovery handler) of the 'EmployeeRecruitmentSystem' project. The file takes the POST parameter 'fpemail' and concatenates it directly into a single MySQL SELECT query without any sanitisation, prepared statement or escaping. The query is also wired to or die(mysql_error()) , which both confirms the use of unparameterised SQL and leaks the full database error message back to the HTTP response. Because the endpoint is reachable without any session or login, an unauthenticated remote attacker can fully control the fpemail value and extract the entire database.
The vulnerable code (source/authprocessing.php, lines 9–15):
Because this is the account-recovery endpoint, an unauthenticated attacker can abuse the SQL injection to (a) enumerate which e-mail addresses exist in the account table (boolean blind), (b) read arbitrary data via error-based or UNION techniques (admin e-mails, plaintext passwords, candidate profiles, requirements), (c) read other databases on the same MySQL/MariaDB instance through information_schema , and (d) confirm e-mail existence of any registered user — useful for targeted phishing. No password or session is required to reach the vulnerability.
During the security review of "EmployeeRecruitmentSystem" I discovered a critical, pre-authentication SQL injection vulnerability in the 'source/authprocessing.php' file (the public "forgot password" handler). The vulnerability stems from insufficient validation of the POST parameter 'fpemail', which is interpolated directly into an unparameterised mysql_query statement that is also wired to die(mysql_error()) , leaking raw database error output to the browser. Because the vulnerable endpoint is the public password-recovery handler itself, no account, cookie, or any kind of authorization is required to reach the injection point. An unauthenticated remote attacker can therefore read the entire underlying MySQL/MariaDB database. Immediate remediation is needed to ensure system security and protect data integrity.
Vulnerability location:
POST parameter 'fpemail' in source/authprocessing.php — the public "forgot password" handler, reachable without authentication.
Proof-of-Concept (raw PoC commands, unauthenticated)
sqlmap — full database enumeration (unauthenticated)
The following are screenshots of specific information obtained from testing and running with the sqlmap tool:
Use prepared statements and parameter binding: Replace the raw mysql_query call with mysqli / PDO prepared statements and bind fpemail as a parameter (the legacy mysql_* API is removed from PHP 7+ and deprecated even in 5.5).
Input validation: Enforce a strict e-mail format before the query is built.
Do not leak database errors: Remove or die(mysql_error()) in production; gate them behind a debug flag.
Be aware of account enumeration: Even without injection, returning "no account found on this email" vs performing recovery is itself an information-disclosure (user enumeration) issue; use a generic response for both cases.
Minimize database user permissions and regularly audit the other mysql_query endpoints ( loginprocessing.php , registerform1/2/3.php , reqformprocessing.php , feedbackprocessing.php ).
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
