CVE-2026-105167: kishor-23 food-waste-management-system donate.php sql injection
A vulnerability was determined in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file admin/donate.php. Executing a manipulation of the argument location can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of kishor-23 food-waste-management-system containing the affected admin/donate.php functionality are exposed. The attack can be performed remotely and requires no privileges or user interaction.
What input is involved in exploitation?
The reported injection point is the location argument handled by admin/donate.php. Manipulating that argument can lead to SQL injection.
How urgent is remediation?
Public exploit disclosure is reported, so the issue may be actively usable by attackers. The vulnerability has high severity with potential confidentiality, integrity, and availability impact.
How can I determine whether my deployment is affected?
Check whether your deployment includes admin/donate.php and processes a location argument. The affected and fixed release versions are not disclosed because the project uses a rolling release model.
Is a vendor fix available?
The available information does not identify an updated release or patch. The project was reportedly notified through an issue report but had not responded at the time of disclosure.