food-waste-management-system CVE-2026-105169

Exploitation requires network reachability to the application's delivery/delivery.php endpoint (the Take Order Handler) and the ability to supply the order_id or delivery_person_id parameters; per the CVSS vector no authentication (PR:N) or user interaction (UI:N) is needed, so default deployments of kishor-23 food-waste-management-system are exploitable by remote unauthenticated attackers. The primary real-world limiting factor is deployment scope - the application must actually be installed and internet-exposed, which is rare for this niche project; there is no configuration toggle or non-default mode noted as a prerequisite in the description.

Signals are mixed and point to a low-to-moderate real-world priority despite a medium CVSS. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, which is genuinely attractive, and a public exploit plus the E:P (Proof-of-Concept) exploit-maturity flag confirm working attack code exists. However, impact is rated only Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), and there is NO CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation - only POC availability, which must not be conflated with in-the-wild use. The dominant mitigating factor is prevalence: this is an obscure open-source hobby/student project (kishor-23/food-waste-management-system) with no known enterprise footprint, so mass exploitation is unlikely and any real risk is confined to the few who have actually deployed this specific codebase. Note a data gap: the project uses rolling releases with no versioning, so there is no fixed/affected version to pivot on, and the maintainer has not responded to the issue report, meaning no official patch is confirmed available.

A remote, unauthenticated attacker sends a crafted request to delivery/delivery.php manipulating the order_id or delivery_person_id parameter in the Take Order Handler, injecting SQL that the backend executes against the application database. A public proof-of-concept exists (referenced via the project's GitHub issue tracker), lowering the barrier to reproduction. Because low complexity and no authentication are required, the attacker can automate probing of any exposed instance to extract or tamper with database contents.