food-waste-management-system CVE-2026-105168

Exploitation requires an authenticated session with access to the admin interface (CVSS PR:L), specifically the admin/admin.php endpoint handling the Order Assignment Block; the attacker then manipulates the order_id or delivery_person_id parameters to inject SQL. The attack is remote over the network with no user interaction, but is limited by the authentication requirement and by the narrow deployment of this specific open-source food-waste-management-system project. No patched version exists because the project is rolling-release and the maintainer has not responded, so all deployments remain exposed.

This is a textbook VulDB-sourced, low-severity flaw in a hobby/student GitHub project, not an enterprise priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack but requires low-level privileges (PR:L) - meaning the attacker must already be an authenticated user, consistent with the vulnerable code residing in admin/admin.php within an admin-facing Order Assignment Block. Impact is only partial across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), yielding the modest 5.3 (Medium) score. Exploit maturity is 'E:P' (Proof-of-Concept), and a public exploit exists via the GitHub issue, so publicly available exploit code exists - but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of real-world or widespread exploitation. The signals are internally consistent (POC exists, low privilege required, low impact) rather than conflicting. Net: a genuine SQL injection worth fixing for anyone running this specific project, but the tiny deployment footprint, required authentication, and absence of KEV/EPSS data make it a low real-world risk rather than an urgent threat. Note the vendor has not responded to the issue report, so no patch is confirmed available.

An authenticated low-privilege user (or an attacker who has obtained admin-panel access) submits a crafted order_id or delivery_person_id parameter to admin/admin.php, injecting SQL into the Order Assignment query. A public proof-of-concept is available via the project's GitHub issue tracker, enabling extraction or tampering of database records such as orders, users, and delivery assignments.