Executive brief
A vulnerability exists in the code-projects Interview Management System, a web application used for managing recruitment interviews. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive candidate information or the disruption of recruitment operations. This attack can be performed remotely without requiring any login credentials.
Technical details
A SQL injection vulnerability exists in code-projects Interview Management System 1.0 within the '\inc\classes\View.php' file. The root cause is the improper neutralization of the 'id' parameter, which is used directly in SQL queries without adequate validation or sanitization. A remote, unauthenticated attacker can exploit this by sending specially crafted GET requests (e.g., via editQuestion.php) to execute arbitrary SQL commands. This can lead to unauthorized data retrieval, modification, or deletion. Public exploits, including error-based and time-based blind SQL injection payloads, have been disclosed. No official patch is currently noted; remediation should involve implementing prepared statements and parameterized queries.
Affected products
- code-projects Interview Management System 1.0
Timeline
- 2026-06-07: disclosed: Initial discovery and report on GitHub by susususua-AI
- 2026-07-09: advisory: NVD publication date