An unauthenticated SQL injection vulnerability in the Online Job Search Engine login module poses a critical risk of database compromise and potential authentication bypass.

The application is vulnerable to SQL injection via the username parameter in login.php due to improper input sanitization and the use of deprecated, insecure database functions. This flaw allows an unauthenticated remote attacker to manipulate backend database queries directly.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary SQL commands against the database. This could result in the total exfiltration of user credentials and sensitive applicant data, unauthorized access to administrative functions, or a complete denial of service. With a CVSS score of 7.3, this high-severity vulnerability represents a significant risk to data confidentiality and integrity.

Immediate Action: As no official patch is currently available, administrators should restrict access to the login page via network-level controls or temporarily disable the affected application until the vendor provides a secure update.

Proactive Monitoring: Review web access logs for anomalous characters typically used in SQL injection attempts, such as single quotes, sleep commands, or comment syntax, specifically targeting the login.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch until the underlying code is remediated.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the vulnerability references.

Given the availability of a public proof-of-concept and the ease of exploitation, immediate action is required to secure the affected environment. Administrators must implement compensating controls such as WAF rules or network segmentation immediately to prevent unauthorized database access, while prioritizing the replacement or patching of this legacy software component.