CVE-2026-105168: SQL Injection in kishor-23 food-waste-management-system

This vulnerability in kishor-23 food-waste-management-system allows remote attackers to perform SQL injection via the order_id or delivery_person_id parameters in an unknown function of admin/admin.php within the Order Assignment Block. The product's rolling release model means no fixed versions or patches are currently available. The vulnerability was responsibly disclosed but remains unaddressed by the vendor. The CVSS 4.0 score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts. Public exploit code is available, increasing risk if unmitigated.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited to confidentiality, integrity, and availability with low severity as per the CVSS vector. No known active exploitation in the wild has been reported.

No official patch or fix is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a fix is provided, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting order_id and delivery_person_id parameters. Avoid exposing the admin interface to untrusted networks if possible.