Quick answers
- Is CVE-2026-105167 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-105167 being exploited in the wild.
- How severe is CVE-2026-105167?
- High severity, with a CVSS score of 7.3, published 4 October 2026.
- Which products and versions are affected?
- Kishor-23 Food-Waste-Management-System commit b3a70b2c492dc9904de5be1ad9389bd79b87f82c and earlier (rolling release, no version numbers).
- Is there a fix for CVE-2026-105167?
- No fixed version is recorded yet. Use prepared statements with parameterized queries for the location filter; enforce admin session verification with exit() before processing POST data; implement input validation against a fixed whitelist (chennai/madurai/coimbatore); use a least-privilege database account instead of root with empty password; apply htmlspecialchars() to all output.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-09", "note": "Vulnerability reported via GitHub issue #7"}, {"kind": "advisory", "at": "2026-10-04", "note": "CVE-2026-105167 published"}, {"kind": "other", "at": "2026-10-04", "note": "Maintainer has not responded to issue"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-105167 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-105167?
- Check whether you run Kishor-23 Food-Waste-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Use prepared statements with parameterized queries for the location filter; enforce admin session verification with exit() before processing POST data; implement input validation against a fixed whitelist (chennai/madurai/coimbatore); use a least-privilege database account instead of root with empty password; apply htmlspecialchars() to all output.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-09", "note": "Vulnerability reported via GitHub issue #7"}, {"kind": "advisory", "at": "2026-10-04", "note": "CVE-2026-105167 published"}, {"kind": "other", "at": "2026-10-04", "note": "Maintainer has not responded to issue"}]
Technical details
A UNION-based SQL injection exists in admin/donate.php where the location POST parameter is inserted directly into a WHERE clause without escaping or prepared statements. The vulnerability is unauthenticated because the session verification redirect lacks an exit() call, allowing the vulnerable code to execute regardless of login status. Query results are reflected in the HTML response, enabling full database disclosure including credentials and PII.
Affected products
- kishor-23 food-waste-management-system commit b3a70b2c492dc9904de5be1ad9389bd79b87f82c and earlier (rolling release, no version numbers)