CVE-2026-122038: krupalshah EmployeeRecruitmentSystem SQL injection in requirement update handler

CVE-2026-122038 · Severity: high · CVSS 7.3 · Published 2026-11-04

EmployeeRecruitmentSystem is a recruitment management application that handles job postings and candidate data. An unauthenticated SQL injection vulnerability in the requirement update endpoint allows remote attackers to extract sensitive information from the database, including candidate emails and plaintext passwords, or modify recruitment records. The application has been unsupported since 2016 and does not use versioning, making patches unavailable.

Technologies: Krupalshah EmployeeRecruitmentSystem. Vendors: Krupalshah.

Quick answers

Is CVE-2026-122038 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-122038 being exploited in the wild.
How severe is CVE-2026-122038?
High severity, with a CVSS score of 7.3, published 4 November 2026.
Which products and versions are affected?
Krupalshah EmployeeRecruitmentSystem V1.0 (up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe).
Is there a fix for CVE-2026-122038?
No fixed version is recorded yet. Use prepared statements and parameter binding with mysqli or PDO to replace raw mysql_query calls; never interpolate user input directly into SQL queries. Restrict access to source/reqformprocessing.php to authenticated users only.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-122038 attacked?
It is attacked over the network.
Am I affected by CVE-2026-122038?
Check whether you run Krupalshah EmployeeRecruitmentSystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Use prepared statements and parameter binding with mysqli or PDO to replace raw mysql_query calls; never interpolate user input directly into SQL queries. Restrict access to source/reqformprocessing.php to authenticated users only.</anigation> </invoke>

Technical details

A SQL injection vulnerability exists in source/reqformprocessing.php where POST parameters (postname, vacancy, reqexperience, minsalary, maxsalary) are directly concatenated into an UPDATE query without sanitization, prepared statements, or escaping. The unauthenticated endpoint accepts remote requests and allows attackers to exploit time-based blind SQL injection to extract or modify the entire database. Full database enumeration is possible using automated tools like sqlmap without any authentication.

Affected products

  • krupalshah EmployeeRecruitmentSystem V1.0 (up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe)

Timeline

  • 2026-11-04: disclosed
  • other: Product marked unsupported by vendor since 2016

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.