CVE-2026-105166: SQL Injection in kishor-23 food-waste-management-system

The vulnerability CVE-2026-105166 exists in the kishor-23 food-waste-management-system, specifically in the insert function of the fooddonateform.php file in the Food Donation Form component. Manipulating the image-choice parameter leads to SQL injection, enabling attackers to execute arbitrary SQL commands remotely. The product’s rolling release strategy prevents clear versioning of affected or fixed releases. The vendor has been notified but has not issued a fix or response. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access, data modification, or other database impacts. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, but with low confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. In the meantime, restricting access to the vulnerable component or implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the image-choice parameter may help reduce risk.