EUVD-2026-92253
GHSA-7g4f-f5xc-4jqc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public admin/signup.php form
-
ExploitInject SQL via email/username/location field
-
ExecutionBackend concatenates input into query
-
ImpactExtract or alter database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication, user interaction, or special configuration is required: the vulnerable admin/signup.php registration endpoint must simply be network-reachable, matching the CVSS AV:N/AC:L/PR:N/UI:N vector. Exploitation targets the email, username, or location parameters of the Admin Registration form. The primary limiting factor is deployment scale rather than any technical prerequisite - the product is a small open-source project unlikely to be exposed in production environments; impact is further bounded to Low confidentiality/integrity/availability, so no privilege escalation or system-wide compromise is implied by the available data. |
| Impact | Signals are mixed and point to a low-to-moderate real-world priority despite the network-reachable, unauthenticated nature of the flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation, but all three impact metrics are only Low (VC:L/VI:L/VA:L) and no scope change occurs (SC:N/SI:N/SA:N), which is why the score lands at 6.9 (Medium) rather than Critical - unusual restraint for an unauthenticated SQLi, implying the data reachable through this endpoint is limited. Exploitation maturity is E:P (Proof-of-Concept), consistent with the publicly available exploit referenced in the GitHub issue; there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or at-scale exploitation. The dominant risk-limiting factor is prevalence, not exploitability: this is an individual developer's open-source GitHub project (food-waste-management-system), not enterprise software, so the realistic attack surface is minimal. Note a reporting caveat - this is a VulDB-sourced entry with rolling-release versioning and no vendor response, so affected/fixed version boundaries are unverifiable. |
| Exploit ScenarioDerived | A remote attacker without credentials submits crafted input in the email, username, or location field of the admin registration form at admin/signup.php, injecting SQL that the application concatenates into a query. A public proof-of-concept exists (referenced in GitHub issue #15), lowering the skill needed to reproduce the attack, allowing extraction or modification of limited database contents. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Unauthenticated SQL injection in the kishor-23 Food Waste Management System allows remote attackers to tamper with database queries through the Admin Registration handler at admin/signup.php, manipulating the email, username, and location parameters. Because the vulnerable endpoint is the public signup form, no authentication, user interaction, or special configuration is needed - the only practical prerequisite is that the application be network-reachable. Publicly available exploit code exists (documented in the project's GitHub issue #15 and catalogued by VulDB), and the vendor has not responded to the report; no CISA KEV listing has been observed, so this is exploit-code availability rather than confirmed active exploitation. Per the authoritative assessment the impact is bounded to Low confidentiality, integrity, and availability with no privilege escalation or system-wide compromise implied, making this a low-to-moderate real-world priority driven by the small deployment footprint of an open-source project unlikely to be exposed in production.
RemediationAI
No vendor-released patch identified at time of analysis: the project was notified early via issue #15 (https://github.com/kishor-23/food-waste-management-system/issues/15) and, per the description, has not responded or issued a fix, so no fixed version number can be cited. Deployers should treat the code as unpatched and take compensating measures: apply the upstream code fix themselves by converting the email, username, and location lookups in admin/signup.php to parameterized/prepared statements (PDO or mysqli with bound parameters) - the only control that addresses the root cause, at the cost of maintaining a local fork; block or remove network access to admin/signup.php at the reverse proxy or web server if self-registration is not required, accepting that legitimate admin registration will break; restrict the path to trusted source IPs or place it behind authentication if the signup flow must remain reachable, which reduces the unauthenticated attack surface but adds an access step for legitimate users; and deploy WAF signatures for SQL injection on the signup parameters as a stopgap, recognizing that signature evasion is possible and this does not fix the underlying flaw. Given the Low-severity bounded impact and the limited production exposure of this project, most organizations should prioritize simply not exposing the application to untrusted networks. Monitor https://vuldb.com/vuln/413431 and https://github.com/kishor-23/food-waste-management-system/ for any future vendor commit, since the rolling-release model means no formal advisory or version bump will necessarily mark a fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL injection in a PHP web application. The Admin Registration component reads user-supplied values from the email, username, and location fields of the signup form and passes them into a SQL query - almost certainly built by direct string concatenation rather than parameterized statements - so an attacker can alter the query's structure and logic. The CPE string cpe:2.3:a:kishor-23:food-waste-management-system:*:*:*:*:*:*:*:* identifies the affected product as the kishor-23 GitHub project without version binding, consistent with the description's note that the project uses a rolling-release model (continual delivery) so no fixed affected/updated version numbers exist; the referenced commit hashes 411989e3ecb82895e53dca7865f72145f03d7d93 and b3a70b2c492dc9904de5be1ad9389bd79b87f82c pin the state at which the issue was observed. Both the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the independent CVSS v3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) agree the attack is remote and unauthenticated with no user interaction, while scope is unchanged and impact is confined to Low across all three metrics. Exploitation targets the admin/signup.php endpoint of the Admin Registration flow.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Unauthenticated remote form input (AV:N/AC:L/PR:N/UI:N) yields SQLi with limited data exposure/modification, so C/I/A are Low and scope unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The affected element is an unknown function of the file admin/signup.php of the component Admin Registration. The manipulation of the argument email/username/location results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB