# CVE-2026-105166: food-waste-management-system SQL injection in Food Donation Form

Source: https://junglewise.ai/threats/cve-2026-105166-a-vulnerability-was-found-in-kishor-23-food-waste-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-04. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105166 · Severity: high · CVSS 7.3 · Published 2026-10-04

Food-waste-management-system is a web application for donating and managing food waste. An unauthenticated attacker can inject SQL commands through the donation form to extract sensitive data like admin passwords, or manipulate donation records without any authentication or user interaction required.

Technologies: [Kishor-23 Food-Waste-Management-System](https://junglewise.ai/threats/technologies/food-waste-management-system). Vendors: [Kishor-23](https://junglewise.ai/threats/vendors/kishor-23).

## Quick answers

**Is CVE-2026-105166 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105166 being exploited in the wild.

**How severe is CVE-2026-105166?** High severity, with a CVSS score of 7.3, published 4 October 2026.

**Which products and versions are affected?** Kishor-23 Food-Waste-Management-System rolling release; no specific versions specified.

**Is there a fix for CVE-2026-105166?** No fixed version is recorded yet. Escape the image-choice parameter or use prepared statements for all database fields, and validate it against a fixed allowlist (raw-food|cooked-food|packed-food). Ensure exit() or die() is called immediately after every authentication redirect, and use a least-privilege database account instead of root.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-09"}, {"kind": "advisory", "at": "2026-10-04"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105166 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105166?** Check whether you run Kishor-23 Food-Waste-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Escape the image-choice parameter or use prepared statements for all database fields, and validate it against a fixed allowlist (raw-food|cooked-food|packed-food). Ensure exit() or die() is called immediately after every authentication redirect, and use a least-privilege database account instead of root.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-09"}, {"kind": "advisory", "at": "2026-10-04"}]

## Technical details

A time-based blind SQL injection vulnerability exists in fooddonateform.php where the POST parameter "image-choice" is concatenated directly into an INSERT query without escaping. The authentication check fails to call exit() after redirecting unauthenticated users, allowing the malicious SQL to execute anyway. An attacker can use SLEEP()-based payloads to exfiltrate database contents or inject subqueries to extract sensitive data into donation records visible in the admin panel.

## Affected products

- kishor-23 food-waste-management-system rolling release; no specific versions specified

## References

- [https://github.com/kishor-23/food-waste-management-system/](https://github.com/kishor-23/food-waste-management-system/)
- [https://github.com/kishor-23/food-waste-management-system/issues/6](https://github.com/kishor-23/food-waste-management-system/issues/6)

## Related threats

- [kishor-23 food-waste-management-system session fixation in login](https://junglewise.ai/threats/cve-2026-105233-a-vulnerability-has-been-found-in-kishor-23-food-waste)
- [food-waste-management-system SQL injection in registration page](https://junglewise.ai/threats/cve-2026-105232-a-flaw-has-been-found-in-kishor-23-food-waste-management-system)
- [Food Waste Management System SQL injection in admin registration](https://junglewise.ai/threats/cve-2026-105231-a-vulnerability-was-detected-in-kishor-23-food-waste-management)
- [food-waste-management-system SQL injection in delivery order handling](https://junglewise.ai/threats/cve-2026-105230-a-security-vulnerability-has-been-detected-in-kishor-23-food)
- [kishor-23 food-waste-management-system SQL injection in signup.php](https://junglewise.ai/threats/cve-2026-105229-a-weakness-has-been-identified-in-kishor-23-food-waste)