The CVSS 7.3 assigned to this SQL injection is misleading. What you're dealing with is an unauthenticated SQL injection in a password recovery endpoint—a worst-case deployment context that the scoring framework wasn't designed to capture.
The core problem isn't the vulnerability itself; string concatenation in a username field during password recovery is a well-documented anti-pattern that has persisted for three decades. The problem is the deployment context: this code originates from a community-code repository with no vendor security contact, no patch cycle, and no clear remediation path. When the advisory states 'exploit has been disclosed and may be used,' understand that this isn't a future warning—it describes the entire timeline. There's no vendor to coordinate with, no staged release, no patch Tuesday. Public disclosure is mass exploitation day zero simultaneously.
The secondary attack chain is what makes this genuinely dangerous. Beyond extracting user data, an attacker can likely retrieve password reset tokens or security question responses from the same database queries, enabling direct account takeover without ever touching credential hashes. For a job portal, this means not just stolen credentials but verified employment histories, resumes, and PII—high-value data for credential stuffing and targeted social engineering.
There's also a detection problem: CVEs against orphaned code-projects often surface in systems that nobody remembers deploying. Security tooling will flag this, but the organization may not recognize the software as something they run—it's buried in some internal tool someone deployed years ago and forgot about. Treat this CVE as an active incident requiring immediate triage, not a prioritization exercise to schedule for next week.
If you find this in your environment, the realistic remediation path isn't waiting for a vendor patch—it means either isolating the system entirely or rebuilding the authentication layer with parameterized queries, because the original code may never have existed in a secure state.