Description
A security flaw has been discovered in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This impacts an unknown function of the file delivery/delivery.php of the component Take Order Handler. The manipulation of the argument order_id/delivery_person_id results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-04
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL injection enabling data exposure and manipulation
Action: Immediate Patch
AI Analysis

Impact

The flaw lies in the delivery/delivery.php file of the Take Order Handler component, where the parameters order_id and delivery_person_id are not properly validated. An attacker can inject SQL code via these arguments, leading to remote SQL injection. This can allow extraction of sensitive data, modification of database records, and potentially escalation of privileges within the application. The vulnerability is a classic injection flaw corresponding to CWE-74 and a general database injection CWE-89.

Affected Systems

The affected product is the Kishor-23 food-waste-management-system, with no specific version numbers available due to the project’s rolling release approach. The flaw resides in the delivery.php script used for handling order deliveries. Users running any release prior to the fix are potentially exposed.

Risk and Exploitability

The CVSS base score of 6.9 classifies it as a medium severity issue. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the vulnerability can be triggered remotely and the exploit has already been publicly released, the risk of exploitation is significant, especially for systems exposing the affected endpoint to the internet.

Generated by OpenCVE AI on October 5, 2026 at 00:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Kishor-23 food‑waste‑management‑system to the latest commit that includes input validation fixes for order_id and delivery_person_id parameters
  • Deploy a web application firewall or input filtering layer that blocks SQL injection patterns before requests reach the application
  • Apply the principle of least privilege to the database user accessed by the web application, restricting it to only the necessary read/write operations required for normal operation

Generated by OpenCVE AI on October 5, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 04 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This impacts an unknown function of the file delivery/delivery.php of the component Take Order Handler. The manipulation of the argument order_id/delivery_person_id results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Title kishor-23 food-waste-management-system Take Order delivery.php sql injection
First Time appeared Kishor-23
Kishor-23 food-waste-management-system
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:kishor-23:food-waste-management-system:*:*:*:*:*:*:*:*
Vendors & Products Kishor-23
Kishor-23 food-waste-management-system
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Kishor-23 Food-waste-management-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-05T13:19:53.701Z

Reserved: 2026-10-04T08:14:40.655Z

Link: CVE-2026-105169

cve-icon Vulnrichment

Updated: 2026-10-05T13:19:50.336Z

cve-icon NVD

Status : Deferred

Published: 2026-10-05T00:16:58.547

Modified: 2026-10-06T15:04:52.637

Link: CVE-2026-105169

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-05T00:30:18Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')