Executive brief
A vulnerability exists in the Online Job Portal 1.0 software, which is used to manage job listings and applications. An attacker can exploit this flaw to bypass the login screen and gain unauthorized access to the system as an administrator, employer, or job seeker. This could lead to the theft of sensitive user data, unauthorized modification of job postings, or complete takeover of the portal.
Technical details
A SQL injection vulnerability exists in code-projects Online Job Portal 1.0 within the login.php file. The application fails to properly sanitize the 'txtUser' and 'txtPass' parameters before using them in SQL queries. A remote, unauthenticated attacker can exploit this by submitting crafted SQL commands to bypass authentication for administrator, employer, or job seeker accounts. Public exploits demonstrate that this can be used to dump database contents, including credentials, using automated tools like sqlmap. Remediation requires the implementation of prepared statements and parameterized queries.
Affected products
- code-projects Online Job Portal 1.0
Timeline
- 2026-07-04: disclosed: Initial disclosure and public exploit release.
- 2026-07-04: advisory