Description
A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This issue affects the function mysqli_real_escape_string of the file payment/pay.php. The manipulation of the argument f_no/farmer results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Assess Impact
AI Analysis

Impact

A flaw in the payment/pay.php module of the Dav-ee dairy-management-system allows an attacker to manipulate the f_no and farmer arguments without proper sanitization via mysqli_real_escape_string, enabling a classic SQL injection. The injection could lead to unauthorized read, modification, or deletion of database records, compromising confidentiality and integrity. The flaw is identified as a string manipulation weakness (CWE-74) and a classic SQL injection vulnerability (CWE-89).

Affected Systems

The vulnerability affects the Dav-ee dairy-management-system, with no specific version tags provided due to the project’s rolling release model. Any current or future release of the system may contain the flaw until an official fix is released.

Risk and Exploitability

The CVSS score of 5.3 reflects a moderate severity impact. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, but the public exploit exists and can be triggered remotely by sending crafted requests to payment/pay.php. Because the flaw lies in a widely accessed payment endpoint, the risk to systems that process sensitive farm data is significant, but there is no evidence of supply chain or elevated privilege escalation at this time.

Generated by OpenCVE AI on October 19, 2026 at 08:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any newer release or patch for Dav-ee dairy-management-system when it becomes available
  • Restrict remote access to payment/pay.php or the f_no/farmer parameter using authentication, IP filtering, or network segmentation
  • Enforce least‑privilege database accounts, validate and sanitize all input, and consider refactoring database queries to use prepared statements

Generated by OpenCVE AI on October 19, 2026 at 08:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This issue affects the function mysqli_real_escape_string of the file payment/pay.php. The manipulation of the argument f_no/farmer results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Title Dav-ee dairy-management-system pay.php mysqli_real_escape_string sql injection
First Time appeared Dav-ee
Dav-ee dairy-management-system
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:dav-ee:dairy-management-system:*:*:*:*:*:*:*:*
Vendors & Products Dav-ee
Dav-ee dairy-management-system
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Dav-ee Dairy-management-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-19T07:00:11.646Z

Reserved: 2026-10-18T16:25:45.738Z

Link: CVE-2026-112090

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T08:17:02.813

Modified: 2026-10-19T08:17:02.813

Link: CVE-2026-112090

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T08:30:13Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')