CVE-2026-105230: SQL Injection in kishor-23 food-waste-management-system

This vulnerability involves SQL injection in the kishor-23 food-waste-management-system, specifically in an unknown function of delivery/deliverymyord.php. By manipulating the delivery_person_id or order_id parameters, an attacker can inject SQL commands remotely without any privileges or user interaction. The product uses a rolling release approach, so no discrete versioning information is available for affected or patched releases. The vulnerability was disclosed publicly, and the project has not yet responded or issued a fix.

Successful exploitation allows an unauthenticated remote attacker to perform SQL injection attacks, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should monitor official channels for updates. Until a fix is available, consider restricting access to the vulnerable endpoint or applying web application firewall rules to detect and block SQL injection attempts targeting delivery_person_id and order_id parameters.