SQL injection in food-waste-management-system Registration deliverysignup.php
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
CVE-2026-105232: A flaw in the Registration page of kishor-23 food-waste-management-system, in the file delivery/deliverysignup.php, allows SQL injection through the username, email and location arguments. The attack can be started remotely, and a published exploit may be used. The product uses continuous delivery with rolling releases, so no affected or fixed versions are listed, and the affected commits are 411989e3ecb82895e53dca7865f72145f03d7d93 and b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The CVSS 4.0 base score is 6.9 (MEDIUM), mapped to CWE-89 and CWE-74.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file delivery/deliverysignup.php of the component Registration Page. This manipulation of the argument username/email/location causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| kishor-23 | food-waste-management-system | 411989e3ecb82895e53dca7865f72145f03d7d93; b3a70b2c492dc9904de5be1ad9389bd79b87f82c | — | No fix listed | CNA |
- food-waste-management-system Vendorkishor-23 Affected 411989e3ecb82895e53dca7865f72145f03d7d93; b3a70b2c492dc9904de5be1ad9389bd79b87f82c Fixed in — No fix listed CNA
Remediation
No fixed release is listed, and the project has not responded to the early issue report. Until a fix is available, use parameterized queries for the username, email and location inputs in delivery/deliverysignup.php, or restrict access to the registration page.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-05 Threatist record created from CVE-2026-105232
- 2026-10-05 Alias added: GHSA-6cjw-wvx3-vfm6
- 2026-10-05 Priority changed: MEDIUM → LOW
- 2026-10-07 CISA SSVC decision points changed
- 2026-10-07 Priority changed: LOW → HIGH
References
More kishor-23 vulnerabilities
- TI-2024-02377 kishor-23 Food Waste Management System admin.php improper authorization CVSS 3.1CRITICAL 9.1
- TI-2026-67703 SQL injection in kishor-23 food-waste-management-system admin signup CVSS 4.0MEDIUM 6.9
- TI-2026-67702 SQL injection in kishor-23 food-waste-management-system delivery page CVSS 4.0MEDIUM 6.9
- TI-2026-67701 SQL injection in kishor-23 food-waste-management-system signup.php CVSS 4.0MEDIUM 6.9
- TI-2026-67676 Missing authentication in kishor-23 food-waste-management-system CVSS 4.0MEDIUM 6.9
- TI-2026-67675 SQL injection in kishor-23 food-waste-management-system order handler CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-105232 · CVE Program
- CVE-2026-105232 · NVD
- FIRST EPSS
- GHSA-6cjw-wvx3-vfm6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences