EmployeeRecruitmentSystem vulnerabilities

A SQL Injection vulnerability was found in EmployeeRecruitmentSystem (krupalshah) in /source/registerform2.php within the mysql_query function. Manipulating the university/institute/branch/degree/status/cpi/semester/experience arguments enables remote attack, and the exploit has been publicly disclosed. The product is no longer supported, and the vendor did not respond to the disclosure.

A SQL injection vulnerability was detected in krupalshah EmployeeRecruitmentSystem within the mysql_query function of /source/registerform1.php. Manipulation of the firstname, middlename, lastname, gender, birthdate, state, statespecify, city, and cityspecify arguments allows SQL injection. The exploit is publicly available and can be launched remotely.

A SQL Injection vulnerability in krupalshah EmployeeRecruitmentSystem (up to a specific commit) affects the mysql_query function in source/adminregister.php of the Registration Handler component, allowing remote SQL injection.

A SQL Injection vulnerability in krupalshah EmployeeRecruitmentSystem (up to a specific commit) affects the mysql_query function in source/authprocessing.php of the Forgot Password Handler component, where manipulation of the fpemail argument leads to SQL injection.

A SQL Injection vulnerability in krupalshah EmployeeRecruitmentSystem (up to a specific commit) affects the mysql_query function in source/loginprocessing.php of the Login Handler component, where manipulation of email/password arguments leads to SQL injection.