V1.0 (master branch, no version tags; repository marked "This project is no longer maintained" by the original vendor since 2016)
SQL injection (error-based + time-based blind + boolean-based blind)
A SQL injection vulnerability was found in the 'source/registerform3.php' file (the final step of the multi-page registration wizard) of the 'EmployeeRecruitmentSystem' project. The file takes five POST parameters ( post , resume , pemail , semail , setpassword ) and concatenates them directly into an INSERT statement without any sanitisation, prepared statement or escaping. The pemail parameter is the most convenient injection point. Because the registration flow is public, no account, cookie, or authorization is required to reach the injection point.
The vulnerable code (source/registerform3.php, lines 6–17):
An unauthenticated remote attacker can manipulate the pemail (or any of the five) parameter to break out of the INSERT string literal and inject arbitrary SQL. The observable effects are: the request returns HTTP 200 with a "Database error" message when the injected SQL is malformed, versus HTTP 302 redirect to finish.php on a clean insert — a reliable boolean oracle. A SLEEP() payload inside the value triggers a measurable time delay (time-based blind), allowing full blind extraction of the entire database (candidate e-mails, plaintext passwords, requirements, etc.) without authentication. Note that the application does not echo mysql_error() for this endpoint, so the error-based confirmation relies on the boolean/200-vs-302 oracle and the timing channel.
During the security review of "EmployeeRecruitmentSystem" I discovered a critical, pre-authentication SQL injection vulnerability in the 'source/registerform3.php' file (the public registration wizard, final step). The vulnerability stems from insufficient validation of the POST parameters, which are interpolated directly into an unparameterised mysql_query INSERT statement. Because the registration endpoint is reachable without any authentication, an unauthenticated remote attacker can inject SQL and read (and even write) the underlying MySQL/MariaDB database. Immediate remediation is needed to ensure system security and protect data integrity.
Vulnerability location:
POST parameter 'pemail' (and post , resume , semail , setpassword ) in source/registerform3.php — the public registration wizard, reachable without authentication.
Proof-of-Concept (raw PoC commands, unauthenticated)
sqlmap — full database enumeration (unauthenticated, time-based blind)
The following are screenshots of specific information obtained from testing and running with the sqlmap tool:
Use prepared statements and parameter binding: Replace the raw mysql_query INSERT with mysqli / PDO prepared statements and bind all five parameters. Never interpolate user input into SQL text.
Input validation: Validate pemail / semail as e-mail addresses and setpassword against a strength policy before the query runs.
Generic error handling: Do not disclose "Database error" details; return a uniform message and log the exception server-side.
CSRF / abuse protection: Add CSRF tokens and rate-limiting to the registration endpoint to prevent automated abuse and injected-mass-registration.
Minimize database user permissions and regularly audit the other mysql_query endpoints.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
