Dairy Management System CVE-2026-112090

Exploitation requires an authenticated low-privileged session (CVSS PR:L) that can reach the payment/pay.php endpoint and submit the f_no or farmer request parameter, which is passed to a query where mysqli_real_escape_string is misapplied (e.g., used on a non-string/numeric context or without surrounding quoting) so escaping does not prevent injection. No user interaction and no special non-default configuration are stated as necessary. The limiting factors are the need for valid credentials and access to the payment feature; a fully unauthenticated attacker cannot reach the vulnerable code path based on the provided vector.

This is a moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity SQL injection, but PR:L means the attacker must already hold a low-privileged authenticated account, which meaningfully narrows the attacker population. Impact is rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no scope change, yielding a modest 5.3 base score. The E:P temporal flag and the 'exploit is now public' statement are consistent with the reported public POC, but there is NO CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation - public exploit code is a distinct and lower signal than confirmed in-the-wild use. Weighing these together: a genuine, publicly-exploitable SQLi, but gated behind authentication, limited to low technical impact, and present in an obscure open-source product the vendor has not patched. The practical risk is real for anyone running this specific application but low in absolute terms given the small deployment footprint and the authentication prerequisite.

An attacker with a valid low-privileged account on an exposed dairy-management-system instance sends a crafted value in the f_no or farmer parameter to payment/pay.php, where input reaches a query despite a misused mysqli_real_escape_string call, injecting SQL. A public proof-of-concept exists (GitHub issue #4), lowering the effort to reproduce. The attacker can read or tamper with payment and farmer records in the backing database.