EUVD-2026-92254
GHSA-6cjw-wvx3-vfm6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach registration page over network
-
ExploitSubmit crafted username/email/location input
-
ExecutionInject SQL into backend query
-
ImpactExtract or modify database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration is required: exploitation targets the default delivery-partner registration flow (delivery/deliverysignup.php, the Registration Page component) of the food-waste-management-system application, and the injectable parameters are the standard username, email, and location form fields. Per the CVSS vector (PR:N/UI:N/AC:L/AT:N), no authentication, no user interaction, and no special timing are needed - the only real limiting factor is that an instance of this niche project must be deployed and network-reachable, and impact is bounded to the partial C/I/A (VC:L/VI:L/VA:L) the record assigns rather than full database compromise. |
| Impact | This is a textbook high-CVSS-but-low-real-world-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) legitimately describes an unauthenticated, remote, low-complexity SQL injection, and the provided E:P (Proof-of-Concept) exploit maturity is consistent with the publicly available PoC filed as a GitHub issue. However, the impact metrics are only partial (VC:L/VI:L/VA:L), and critically the affected product - kishor-23's 'food-waste-management-system' - is an individual open-source GitHub project with no identifiable production or enterprise deployment footprint, which caps the practical urgency regardless of the network-reachable vector. EPSS is NOT provided in the input, and the CVE is NOT on CISA KEV, so there is no signal of active or widespread exploitation; the only exploitation signal is PoC availability (distinct from exploitation in the wild). No SSVC decision data was supplied. Conflicting/weak signals to note explicitly: the record was reported by VulDB for a tiny hobby project, versions are unspecified (rolling releases), and the maintainer has not responded - so patch status is unknown and defenders of any real deployment cannot pin a fixed commit. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker submits the registration form at delivery/deliverysignup.php and injects crafted SQL through the username, email, or location fields, tampering with the backend query to read or alter database contents. A public proof-of-concept exists (referenced via the project's GitHub issue tracker), and the AV:N/AC:L/PR:N/UI:N vector means no authentication, user interaction, or special timing is required against a reachable instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Unauthenticated SQL injection in the delivery-partner registration page (delivery/deliverysignup.php) of kishor-23's food-waste-management-system PHP project allows remote attackers to manipulate the username, email, and location form fields to inject arbitrary SQL. The flaw affects the project as shipped on its rolling-release branches (no fixed version details are published), and publicly available exploit code exists, though there is no indication of confirmed active exploitation. Per the assessed impact, an attacker can achieve only partial confidentiality, integrity, and availability loss rather than full database takeover, and exploitation requires that a network-reachable instance of this niche application be deployed.
RemediationAI
No vendor-released patch identified at time of analysis: the project was notified through the issue report at https://github.com/kishor-23/food-waste-management-system/issues/14 but has not responded, and the rolling-release model means there is no fixed version number to upgrade to - so the only definitive fix is to apply parameterized queries (PDO/MySQLi prepared statements) to the username, email, and location inputs in delivery/deliverysignup.php in a local fork and redeploy, or to pull a later upstream commit only after independently verifying the fix. Until then, actionable compensating controls are: take the application off the public internet or place it behind an authenticating reverse proxy/VPN, since the assessed impact and exploitability depend on the instance being network-reachable; disable or remove the delivery-partner registration endpoint (delivery/deliverysignup.php) if the workflow is not needed, accepting the loss of that functionality; and deploy WAF or proxy rules that block SQL metacharacters and UNION/boolean-based injection patterns on POST bodies to that path, understanding that WAF signatures are bypassable and provide defense in depth rather than a fix. Add server-side input validation and allow-listing on the registration fields and monitor database and web logs for anomalous query errors as a detection measure; none of these substitutes for patching the underlying concatenated query.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic SQL injection (CWE-89) in a PHP web application. The affected code lives in delivery/deliverysignup.php, the delivery-partner registration handler, where user-supplied values for username, email, and location are concatenated into a database query without parameterization or escaping, letting an attacker alter query semantics. The CPE entry cpe:2.3:a:kishor-23:food-waste-management-system:*:*:*:*:*:*:*:* carries wildcard version components, reflecting the project's continuous-delivery/rolling-release model in which no discrete affected or fixed version numbers are published; EUVD instead enumerates two repository snapshots, b3a70b2c492dc9904de5be1ad9389bd79b87f82c and 411989e3ecb82895e53dca7865f72145f03d7d93. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the endpoint is reachable over the network and exploitable without authentication or user interaction, and the E:P metric reflects that exploit code is already public; the record nonetheless bounds the impact to low confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no scope change, meaning the injection is assessed as yielding partial, not systemic, compromise.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Unauthenticated remote injection via a public registration form gives AV:N/AC:L/PR:N/UI:N; impact kept at C:L/I:L/A:L to match the record's partial-impact assessment rather than full DB compromise.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file delivery/deliverysignup.php of the component Registration Page. This manipulation of the argument username/email/location causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB