Dairy Management System CVE-2026-112089

Exploitation requires an authenticated session with high privileges (CVSS PR:H) able to reach the employee-deletion feature at employees/delete.php; the attacker then supplies a malicious e_payroll_no value that is passed unsanitized into a mysqli_query call. The vulnerability is network-reachable with no user interaction and low complexity, but the PR:H requirement is the primary limiting factor - it is not exploitable by anonymous/unauthenticated remote users. No specific non-default configuration is named in the description; the flaw appears present in the standard application code path. Affected versions cannot be pinned due to the rolling-release model.

This is a low-priority issue despite being a remotely reachable SQL injection (CWE-89). The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N) scores only 2.0, and the dominant reason is PR:H - exploitation requires an already highly-privileged authenticated session, which sharply reduces real-world risk. The impact metrics are all Low (VC:L/VI:L/VA:L), suggesting constrained rather than full-database compromise. Publicly available exploit code exists (disclosed in the project's own GitHub issue tracker), which raises opportunistic risk, but this must NOT be conflated with active exploitation: there is no CISA KEV listing and no EPSS score was provided in the input, so there is no signal of widespread or automated exploitation. The signals are internally consistent - a genuine but low-severity flaw gated behind high privilege. The main caveat is that SQL injection in a delete endpoint often permits broader data read/modification than VC:L/VI:L/VA:L implies; the Low impacts appear conservative and the PR:H gating is the real limiting factor. No EPSS/SSVC data was supplied, so exploitation-probability modeling cannot be cross-referenced.

An authenticated user who already holds high privileges in the dairy-management-system web application submits a crafted value in the e_payroll_no parameter to employees/delete.php, injecting SQL into the mysqli_query call to read or tamper with database contents beyond their intended scope. Because the attack is network-reachable and publicly documented, a malicious or compromised privileged account could reproduce it directly from the disclosed GitHub issue proof-of-concept.