Executive brief
CodeAstro Online Job Portal, a web application for managing job listings and applications, contains a security flaw in its application status tracking component. An attacker can exploit this to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive user information or disruption of the job portal services. This vulnerability can be exploited remotely without requiring any login credentials.
Technical details
A SQL injection vulnerability exists in CodeAstro Online Job Portal 1.0 within the '/users/application_status.php' endpoint. The root cause is the improper neutralization of the 'id' GET parameter before it is used in a MySQL query. An unauthenticated remote attacker can supply crafted SQL payloads (including boolean-based blind, error-based, and time-based techniques) to bypass security controls. Successful exploitation allows for unauthorized database enumeration, data exfiltration, and potential system compromise. A public exploit (PoC) has been disclosed, and remediation involves implementing prepared statements with parameterized queries.
Affected products
- CodeAstro Online Job Portal Project 1.0
Timeline
- 2026-03-21: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-06-01: advisory: CVE published and indexed by NVD/VulDB