food-waste-management-system Auth Bypass Flaws

Missing authentication in the Admin Signup component (admin/signup.php) of the kishor-23 Food Waste Management System allows remote, unauthenticated attackers to manipulate the 'sign' argument and bypass the intended signup/authentication check, resulting in limited confidentiality, integrity, and availability impact on the affected endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, E:P) confirms the attack is network-reachable, requires no credentials or user interaction, and that publicly available exploit code exists; there is no CISA KEV entry, so active exploitation in the wild is not confirmed. Real-world risk is modest: the project is an obscure open-source PHP application, generally not deployed at production scale, and the project has not responded to the issue report, meaning no patched release is available.

Authorization bypass in the kishor-23 Food Waste Management System (a PHP web application) allows an authenticated low-privilege user to send a crafted remote request to admin/admin.php and manipulate the 'Name' argument processed by the Role Attribute Handler, thereby obtaining elevated role attributes and reaching administrative functionality across multiple endpoints. Upstream has not responded to the early issue report, the project does not use versioning, and publicly available exploit code exists (CVSS 4.0 E:P proof-of-concept), though the issue is not listed in CISA KEV and no active exploitation is confirmed. Consistent with our independent assessment, impact is limited to low confidentiality, integrity and availability loss, so this is a low-priority but still remediable flaw that requires only a standard authenticated account and no user interaction.