V1.0 (master branch, no version tags; repository marked "This project is no longer maintained" by the original vendor since 2016)
SQL injection (boolean-based blind + time-based blind; error-based not reflected)
A SQL injection vulnerability was found in the 'source/registerform1.php' file (step 1 of the multi-page registration wizard) of the 'EmployeeRecruitmentSystem' project. The file takes nine POST parameters ( firstname , middlename , lastname , gender , birthdate , state , statespecify , city , cityspecify ) and concatenates them directly into an INSERT statement without any sanitisation, prepared statement or escaping. The firstname parameter (and all nine) is the injection point. The endpoint is reachable without any session or login.
The vulnerable code (source/registerform1.php, lines 5–18):
An unauthenticated remote attacker can manipulate firstname (or any of the nine parameters) to break out of the string literal and inject arbitrary SQL. The observable effect is a reliable boolean oracle: a clean insert returns HTTP 302 redirect to register2.php , whereas an injected value that breaks the SQL returns HTTP 200 with a "Database error" message. A SLEEP() payload inside the value triggers a measurable time delay (time-based blind), allowing full blind extraction of the entire database (candidate e-mails, plaintext passwords, requirements, etc.) without authentication.
During the security review of "EmployeeRecruitmentSystem" I discovered a critical, pre-authentication SQL injection vulnerability in the 'source/registerform1.php' file (the public registration wizard, step 1). The vulnerability stems from insufficient validation of the POST parameters, which are interpolated directly into an unparameterised mysql_query INSERT statement. Because the registration endpoint is reachable without any authentication, an unauthenticated remote attacker can inject SQL and read (and even write) the underlying MySQL/MariaDB database. Immediate remediation is needed to ensure system security and protect data integrity.
Vulnerability location:
POST parameter 'firstname' (and middlename , lastname , gender , birthdate , state , statespecify , city , cityspecify ) in source/registerform1.php — the public registration wizard, reachable without authentication.
Proof-of-Concept (raw PoC commands, unauthenticated)
sqlmap — full database enumeration (unauthenticated, time-based blind)
The following are screenshots of specific information obtained from testing and running with the sqlmap tool:
Use prepared statements and parameter binding: Replace the raw mysql_query INSERT with mysqli / PDO prepared statements and bind all nine parameters. Never interpolate user input into SQL text.
Input validation: Validate each field against an expected type/format (names as non-SQL text, dates, enums) before the query runs.
Generic error handling: Do not disclose "Database error" details; return a uniform message and log the exception server-side.
Minimize database user permissions and regularly audit the other mysql_query endpoints ( loginprocessing.php , authprocessing.php , registerform2.php , registerform3.php , reqformprocessing.php ).
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
