CVE-2023-41014 is a critical SQL injection in code-projects Online Job Portal 1.0. NVD scores it 9.8. The Username parameter used for the Employer login is vulnerable. The record names no fixed version, so retire the app or rewrite its database queries to use parameters.
What's affected
The record lists one product and one version: Online Job Portal 1.0 from code-projects.org. The NVD description says the application is vulnerable to SQL injection through the Username parameter for the Employer account type. The weakness is CWE-89, improper neutralization of special elements in an SQL command.
The vector is network, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. That gives the 9.8 score. The score comes from NVD only, and I found no second source that scores it differently.
No fixed version is named. The record's only reference is a GitHub page from an outside researcher. I could not read useful detail from it and make no claims about its contents. It is not in CISA's KEV catalog, and no advisory I could read says it is exploited in the wild.
Code-projects publishes sample applications of the kind used for learning, so a deployment may be a copy of the source rather than an installed package. That matters for how you look for it.
How to check if you're exposed
This is source code that someone copies onto a web server, so a package scan will not find it. Search your hosts and repositories for the project, then read the login code.
# look for the application by name on a web host
grep -ril "online job portal" /var/www 2>/dev/null
# find where the employer login builds its query
grep -rn "employer" --include=*.php /var/www | grep -i "select"
If the login query is built by joining the username into an SQL string, you are exposed. Queries that use prepared statements with bound parameters are not exposed to this class of bug. Also check your internal inventory for any demo or training site that may have been left running on a public address.
What to do now
- Search servers, containers and repositories for Online Job Portal 1.0 and list every copy, including demos.
- Take any public copy offline unless you have a business need for it.
- If you keep it, rewrite the Employer login query to use prepared statements, and review every other query that handles request values.
- Run the database account for this app with the least privilege it needs, so a successful injection reaches less.
- Check web and database logs for unusual login attempts, and rotate any credentials that the database held.
Why it matters
SQL injection is among the oldest web flaws and one of the easiest to prevent. It happens when request values are joined into a query string, so the database cannot tell data from instructions. Parameterized queries keep the two separate and close the hole without changing behaviour.
Sample applications often skip these basics because they were written to teach a feature, not to face the internet. The danger comes when such a project is deployed as is. Treat any copy as untrusted code, and prefer a maintained product for a real job board.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch?
The record names none. The project is a small sample application, so plan to retire it or fix the code yourself.
Will a dependency scan find this?
Probably not. It lives in the application's own source code, so a code scan or a manual search is the better route.
Sources
- NVD record for CVE-2023-41014, as supplied in the Safeguard CVE dataset
- Researcher write-up referenced by NVD (no usable detail could be read)
- Safeguard Gold entry for CVE-2023-41014
Last reviewed: 19 October 2026.
