CVE-2026-105167: SQL Injection in kishor-23 food-waste-management-system

The kishor-23 food-waste-management-system contains a SQL injection vulnerability in an unknown function within the file admin/donate.php. By manipulating the 'location' parameter, an attacker can perform SQL injection remotely without any privileges or user interaction. The product follows a rolling release model, and no specific affected or fixed versions have been disclosed. The vulnerability was reported early to the project, but no response or patch has been issued. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector and low complexity.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database via the 'location' parameter. This may lead to unauthorized data access or modification. The vulnerability is publicly disclosed, increasing the risk of exploitation, but no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor for updates from the project. As a temporary measure, restricting access to admin/donate.php or implementing web application firewall rules to detect and block SQL injection attempts targeting the 'location' parameter may reduce risk.