Dairy Management System
Monthly
Unauthenticated information disclosure in Dav-ee dairy-management-system lets remote attackers manipulate the fname argument of the delivery/checkfarmer.json.php AJAX endpoint to expose sensitive data; affected deployments are rolling-release snapshots such as commits 31ace9692d1e1e6d64339a42c463b361319c615c and f31a584c3330c013b61f8b0306d9e0849c6d693d, and no version-specific fixed release is provided. Publicly available exploit code exists via the project's GitHub issue, but there is no CISA KEV confirmation of active exploitation. Impact is limited to confidentiality (CVSS 4.0 base 6.9; assessed CVSS 3.1 5.3), with no integrity or availability effect, and practical exposure depends on internet-reachable instances of this small-deployment PHP application.
SQL injection in Dav-ee Dairy Management System allows authenticated low-privileged users to manipulate the f_no or farmer parameter in payment/pay.php, potentially reading or altering payment and farmer records. The flaw stems from improper use of mysqli_real_escape_string, and publicly available exploit code exists; active exploitation is not confirmed by CISA KEV. Exploitation requires a valid low-privilege session and access to the payment feature, which limits exposure to authenticated staff accounts rather than unauthenticated internet users.
SQL injection in Dav-ee dairy-management-system's employee deletion handler (employees/delete.php) allows a high-privileged authenticated user to supply a malicious e_payroll_no value that is passed unsanitized into mysqli_query. The issue is remotely reachable with low complexity and no user interaction, but the PR:H requirement limits exploitation to privileged sessions, and impact is assessed as low across confidentiality, integrity, and availability. Publicly available exploit code exists, but no CISA KEV entry or other evidence of active exploitation was provided; affected releases cannot be pinned because the project uses a rolling release model, and no vendor patch has been identified.
SQL injection in Dav-ee Dairy Management System (farmers/add.php) lets an authenticated low-privileged user inject arbitrary SQL through the f_no, f_id, f_name, f_locallity, f_ac, or f_phone parameters, which are passed unsanitized into mysqli_query. The product is not versioned, so all deployments of the identified commits are presumed affected, and publicly available exploit code exists. Real-world risk is LOW despite a public exploit: exploitation requires a valid low-privileged session with access to the add-farmer form, and the product has niche deployment; there is no indication of confirmed active exploitation (no CISA KEV listing).
Unauthenticated information disclosure in Dav-ee dairy-management-system lets remote attackers manipulate the fname argument of the delivery/checkfarmer.json.php AJAX endpoint to expose sensitive data; affected deployments are rolling-release snapshots such as commits 31ace9692d1e1e6d64339a42c463b361319c615c and f31a584c3330c013b61f8b0306d9e0849c6d693d, and no version-specific fixed release is provided. Publicly available exploit code exists via the project's GitHub issue, but there is no CISA KEV confirmation of active exploitation. Impact is limited to confidentiality (CVSS 4.0 base 6.9; assessed CVSS 3.1 5.3), with no integrity or availability effect, and practical exposure depends on internet-reachable instances of this small-deployment PHP application.
SQL injection in Dav-ee Dairy Management System allows authenticated low-privileged users to manipulate the f_no or farmer parameter in payment/pay.php, potentially reading or altering payment and farmer records. The flaw stems from improper use of mysqli_real_escape_string, and publicly available exploit code exists; active exploitation is not confirmed by CISA KEV. Exploitation requires a valid low-privilege session and access to the payment feature, which limits exposure to authenticated staff accounts rather than unauthenticated internet users.
SQL injection in Dav-ee dairy-management-system's employee deletion handler (employees/delete.php) allows a high-privileged authenticated user to supply a malicious e_payroll_no value that is passed unsanitized into mysqli_query. The issue is remotely reachable with low complexity and no user interaction, but the PR:H requirement limits exploitation to privileged sessions, and impact is assessed as low across confidentiality, integrity, and availability. Publicly available exploit code exists, but no CISA KEV entry or other evidence of active exploitation was provided; affected releases cannot be pinned because the project uses a rolling release model, and no vendor patch has been identified.
SQL injection in Dav-ee Dairy Management System (farmers/add.php) lets an authenticated low-privileged user inject arbitrary SQL through the f_no, f_id, f_name, f_locallity, f_ac, or f_phone parameters, which are passed unsanitized into mysqli_query. The product is not versioned, so all deployments of the identified commits are presumed affected, and publicly available exploit code exists. Real-world risk is LOW despite a public exploit: exploitation requires a valid low-privileged session with access to the add-farmer form, and the product has niche deployment; there is no indication of confirmed active exploitation (no CISA KEV listing).