CVE-2026-105229: SQL Injection in kishor-23 food-waste-management-system

This vulnerability in kishor-23 food-waste-management-system (commit 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c) involves SQL injection via the signup.php User Registration Endpoint. Manipulating the email, name, or gender parameters can lead to injection of malicious SQL commands. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 score of 6.9 (medium severity). Exploit code is publicly available. Due to the rolling release model, no specific affected or fixed versions are disclosed. The vendor has not yet provided a patch or mitigation guidance.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database via the signup.php endpoint, potentially leading to unauthorized data access or modification. The vulnerability requires no privileges or user interaction and has low attack complexity. The presence of public exploit code increases the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying input validation or web application firewall rules to block malicious SQL injection payloads targeting the signup.php endpoint parameters (email, name, gender). Monitor for unusual activity related to user registration. The vendor has not yet responded or released an official fix.