V1.0 (master branch, no version tags; repository marked "This project is no longer maintained" by the original vendor since 2016)
SQL injection (boolean-based blind + time-based blind; error-based not reflected)
A SQL injection vulnerability was found in the 'source/registerform2.php' file (step 2 of the multi-page registration wizard) of the 'EmployeeRecruitmentSystem' project. The file takes eight POST parameters ( university , institute , branch , degree , status , cpi , semester , experience ) and concatenates them directly into an INSERT statement without any sanitisation, prepared statement or escaping. All eight parameters are injection points; university is used as the representative parameter. The endpoint is reachable without any session or login.
The vulnerable code (source/registerform2.php, lines 6–18):
An unauthenticated remote attacker can manipulate university (or any of the eight parameters) to break out of the string literal and inject arbitrary SQL. The observable effect is a reliable boolean oracle: a clean insert returns HTTP 302 redirect to register3.php , whereas an injected value that breaks the SQL returns HTTP 200. A SLEEP() payload inside the value triggers a measurable time delay (time-based blind), allowing full blind extraction of the entire database (candidate academic records, e-mails, plaintext passwords, requirements, etc.) without authentication.
During the security review of "EmployeeRecruitmentSystem" I discovered a critical, pre-authentication SQL injection vulnerability in the 'source/registerform2.php' file (the public registration wizard, step 2). The vulnerability stems from insufficient validation of the POST parameters, which are interpolated directly into an unparameterised mysql_query INSERT statement. Because the registration endpoint is reachable without any authentication, an unauthenticated remote attacker can inject SQL and read (and even write) the underlying MySQL/MariaDB database. Immediate remediation is needed to ensure system security and protect data integrity.
Vulnerability location:
POST parameter 'university' (and institute , branch , degree , status , cpi , semester , experience ) in source/registerform2.php — the public registration wizard, reachable without authentication.
Proof-of-Concept (raw PoC commands, unauthenticated)
sqlmap — full database enumeration (unauthenticated, time-based blind)
The following are screenshots of specific information obtained from testing and running with the sqlmap tool:
Use prepared statements and parameter binding: Replace the raw mysql_query INSERT with mysqli / PDO prepared statements and bind all eight parameters. Never interpolate user input into SQL text.
Input validation: Validate each field against an expected type/format (names as non-SQL text, numeric ranges for cpi/semester/experience, enum for status) before the query runs.
Generic error handling: Do not disclose raw error details; return a uniform message and log the exception server-side.
Minimize database user permissions and regularly audit the other mysql_query endpoints ( loginprocessing.php , authprocessing.php , registerform1.php , registerform3.php , adminregister.php , reqformprocessing.php ).
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
