CVE-2025-1162: Anisha Job Recruitment SQLi Vulnerability

CVE-2025-1162 Overview

CVE-2025-1162 is a SQL injection vulnerability in code-projects Job Recruitment 1.0. The flaw exists in the /_parse/load_user-profile.php file, where the userhash parameter is passed directly into a SQL query without proper sanitization. Attackers can exploit this remotely with low-privileged access and no user interaction. The exploit has been publicly disclosed, increasing the risk of opportunistic abuse against exposed installations. The vulnerability is classified under [CWE-89] (SQL Injection) and [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact

Remote attackers can manipulate the userhash parameter to inject arbitrary SQL statements, potentially exposing or modifying backend database contents.

Affected Products

• Anisha Job Recruitment 1.0
• code-projects Job Recruitment distribution
• Deployments using the vulnerable /_parse/load_user-profile.php endpoint

Discovery Timeline

• 2025-02-10 - CVE-2025-1162 published to NVD
• 2025-05-28 - Last updated in NVD database

Technical Details for CVE-2025-1162

Vulnerability Analysis

The vulnerability resides in the /_parse/load_user-profile.php script of the Job Recruitment 1.0 application. The script receives a userhash argument from the client and incorporates it into a SQL query without parameterization or input validation. This allows attackers to break out of the intended query context and append malicious SQL clauses.

The attack is launched over the network and requires only low-level privileges, with no user interaction. Exploitation can disclose user records, modify database state, or chain into further compromise of the recruitment platform. Public disclosure of the exploit details lowers the barrier to weaponization.

Root Cause

The root cause is improper neutralization of user-supplied input within a SQL statement. The application concatenates the userhash value into a database query string rather than using prepared statements or parameter binding. Any character treated as SQL syntax, such as a single quote or boolean operator, alters query semantics.

Attack Vector

An attacker sends a crafted HTTP request to the /_parse/load_user-profile.php endpoint with a tampered userhash parameter. By inserting SQL meta-characters and union or boolean-based payloads, the attacker can extract database content or bypass intended profile-loading logic. Refer to the VulDB entry #295065 and the public proof-of-concept document for technical specifics.

Detection Methods for CVE-2025-1162

Indicators of Compromise

• Inbound HTTP requests to /_parse/load_user-profile.php containing SQL meta-characters such as ', --, UNION, or SLEEP( in the userhash parameter.
• Unusual database error messages or response anomalies tied to the user-profile loading flow.
• Repeated requests to the same endpoint from a single source within short time windows, indicating automated probing.

Detection Strategies

• Deploy web application firewall (WAF) signatures that flag SQL injection patterns targeting userhash query parameters.
• Enable database query logging and alert on syntactically malformed or unusually long queries originating from the application.
• Correlate web access logs with database audit logs to identify injection attempts that reach the data tier.

Monitoring Recommendations

• Continuously monitor authentication and session activity for the Job Recruitment application for anomalous data access patterns.
• Track outbound data transfer volumes from the database server to identify potential bulk exfiltration.
• Alert on any process spawning or file-write activity by the web server account, which may indicate post-exploitation behavior.

How to Mitigate CVE-2025-1162

Immediate Actions Required

• Restrict public exposure of the Job Recruitment 1.0 application until a fix is applied; place it behind authenticated access or a VPN.
• Apply WAF rules that block SQL injection payloads against /_parse/load_user-profile.php.
• Review database logs for prior exploitation attempts and rotate any credentials that may have been exposed.

Patch Information

No official vendor patch is referenced in the published CVE record. Operators should monitor the code-projects website for updated releases and consider replacing the application with a maintained alternative.

Workarounds

• Modify the application source to replace string concatenation in /_parse/load_user-profile.php with parameterized queries or prepared statements.
• Enforce strict input validation on the userhash parameter, allowing only the expected character set and length.
• Apply least-privilege database accounts so the web application cannot perform schema or administrative operations.

# Example WAF rule (ModSecurity) to block SQLi patterns on userhash
SecRule ARGS:userhash "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\(|benchmark\(|--|;|')" \
    "id:1002025,phase:2,deny,status:403,log,msg:'Possible SQLi on userhash (CVE-2025-1162)'"