Quick answers
- Is CVE-2026-105169 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-105169 being exploited in the wild.
- How severe is CVE-2026-105169?
- High severity, with a CVSS score of 7.3, published 5 October 2026.
- Which products and versions are affected?
- Kishor-23 Food-Waste-Management-System commit b3a70b2c492dc9904de5be1ad9389bd79b87f82c and prior.
- Is there a fix for CVE-2026-105169?
- No fixed version is recorded yet. Integer-cast both order_id and delivery_person_id parameters, use prepared statements for all database queries, add exit() after session validation redirects, and implement CSRF tokens on the delivery form.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-105169 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-105169?
- Check whether you run Kishor-23 Food-Waste-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Integer-cast both order_id and delivery_person_id parameters, use prepared statements for all database queries, add exit() after session validation redirects, and implement CSRF tokens on the delivery form.</anigation> </invoke>
Technical details
The delivery/delivery.php component lacks input validation and prepared statements for the order_id and delivery_person_id POST parameters, allowing SQL injection in both UPDATE and SELECT clauses. The authentication check uses header() redirect without exit(), permitting unauthenticated POST requests to reach the vulnerable code. Attackers can perform unauthorized order claims, arbitrarily modify donation table columns, and conduct blind SQL exfiltration via boolean-based injection.
Affected products
- kishor-23 food-waste-management-system commit b3a70b2c492dc9904de5be1ad9389bd79b87f82c and prior
Timeline
- 2026-09-09: disclosed: Issue reported on GitHub
- 2026-10-05: advisory: CVE-2026-105169 published