Quick answers
- Is CVE-2026-105166 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-105166 being exploited in the wild.
- How severe is CVE-2026-105166?
- High severity, with a CVSS score of 7.3, published 4 October 2026.
- Which products and versions are affected?
- Kishor-23 Food-Waste-Management-System rolling release; no specific versions specified.
- Is there a fix for CVE-2026-105166?
- No fixed version is recorded yet. Escape the image-choice parameter or use prepared statements for all database fields, and validate it against a fixed allowlist (raw-food|cooked-food|packed-food). Ensure exit() or die() is called immediately after every authentication redirect, and use a least-privilege database account instead of root.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-09"}, {"kind": "advisory", "at": "2026-10-04"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-105166 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-105166?
- Check whether you run Kishor-23 Food-Waste-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Escape the image-choice parameter or use prepared statements for all database fields, and validate it against a fixed allowlist (raw-food|cooked-food|packed-food). Ensure exit() or die() is called immediately after every authentication redirect, and use a least-privilege database account instead of root.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-09"}, {"kind": "advisory", "at": "2026-10-04"}]
Technical details
A time-based blind SQL injection vulnerability exists in fooddonateform.php where the POST parameter "image-choice" is concatenated directly into an INSERT query without escaping. The authentication check fails to call exit() after redirecting unauthenticated users, allowing the malicious SQL to execute anyway. An attacker can use SLEEP()-based payloads to exfiltrate database contents or inject subqueries to extract sensitive data into donation records visible in the admin panel.
Affected products
- kishor-23 food-waste-management-system rolling release; no specific versions specified