Food Waste Management CVE-2026-105167

Exploitation targets the 'location' request parameter of the admin/donate.php script specifically; an attacker must be able to reach that endpoint and submit attacker-controlled input to 'location'. The source CVSS vector asserts PR:N/UI:N (no authentication, no user interaction) against a network-reachable interface, but the 'admin/' path strongly suggests the page is intended to live behind an administrative login - if session/auth enforcement is present, valid admin access becomes a prerequisite and the real privilege requirement is higher than PR:N indicates. No patched version exists because the project ships as a rolling release, so remediation depends on manual code fixes rather than upgrading to a fixed release.

This is a CWE-89 SQL injection in the 'location' parameter of admin/donate.php in the kishor-23 food-waste-management-system, a small open-source PHP project on GitHub. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack, which would normally make SQLi a high priority; however, the vulnerable file sits under an 'admin/' path, which typically implies an authenticated administrative area. This is a direct conflict: CVSS asserts PR:N (unauthenticated) while the file location implies privileged/admin access may be required - this should be verified against the application's actual session enforcement, as many hobby PHP projects leave admin pages unprotected (which would validate PR:N). The impact metrics are only Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), and the base score is a moderate 6.9, indicating partial rather than full database compromise as rated by the source. On the exploitation side, publicly available exploit information exists (disclosed via GitHub issue #7) and the CVSS reports E:P (Proof-of-Concept), but this CVE is NOT in CISA KEV and NO EPSS score was provided, so there is no evidence of active real-world exploitation - only that PoC-grade exploit code is public. The vendor has not responded to the report, and the project uses a rolling release with no versioned fix, meaning no patched release is identified. Net: this is a credible but moderate, low-prevalence issue - real enough to remediate given public PoC, but not a widespread emergency given the obscure product, Low impact ratings, absence of KEV, and absence of EPSS data.

A remote attacker sends a crafted request to admin/donate.php supplying a malicious value in the 'location' parameter, injecting SQL that the backend executes against the application database. Publicly available exploit information exists (referenced in GitHub issue #7), lowering the effort to reproduce. Because CVSS rates attack complexity Low and impact Low across C/I/A, the attacker can likely read or modify a subset of database records, though whether a prior admin login is required is unconfirmed given the 'admin/' path versus the PR:N rating.