# CVE-2026-105169: kishor-23 food-waste-management-system SQL injection in order handler

Source: https://junglewise.ai/threats/cve-2026-105169-a-security-flaw-has-been-discovered-in-kishor-23-food-waste  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105169 · Severity: high · CVSS 7.3 · Published 2026-10-05

The food-waste-management-system is a web application for coordinating food donation delivery. An unauthenticated attacker can inject SQL commands through order form fields, allowing them to claim any delivery order, modify donation records, and extract sensitive data such as passwords from the database.

Technologies: [Kishor-23 Food-Waste-Management-System](https://junglewise.ai/threats/technologies/food-waste-management-system). Vendors: [Kishor-23](https://junglewise.ai/threats/vendors/kishor-23).

## Quick answers

**Is CVE-2026-105169 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105169 being exploited in the wild.

**How severe is CVE-2026-105169?** High severity, with a CVSS score of 7.3, published 5 October 2026.

**Which products and versions are affected?** Kishor-23 Food-Waste-Management-System commit b3a70b2c492dc9904de5be1ad9389bd79b87f82c and prior.

**Is there a fix for CVE-2026-105169?** No fixed version is recorded yet. Integer-cast both order_id and delivery_person_id parameters, use prepared statements for all database queries, add exit() after session validation redirects, and implement CSRF tokens on the delivery form.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105169 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105169?** Check whether you run Kishor-23 Food-Waste-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Integer-cast both order_id and delivery_person_id parameters, use prepared statements for all database queries, add exit() after session validation redirects, and implement CSRF tokens on the delivery form.</anigation>
</invoke>

## Technical details

The delivery/delivery.php component lacks input validation and prepared statements for the order_id and delivery_person_id POST parameters, allowing SQL injection in both UPDATE and SELECT clauses. The authentication check uses header() redirect without exit(), permitting unauthenticated POST requests to reach the vulnerable code. Attackers can perform unauthorized order claims, arbitrarily modify donation table columns, and conduct blind SQL exfiltration via boolean-based injection.

## Affected products

- kishor-23 food-waste-management-system commit b3a70b2c492dc9904de5be1ad9389bd79b87f82c and prior

## Timeline

- 2026-09-09: disclosed: Issue reported on GitHub
- 2026-10-05: advisory: CVE-2026-105169 published

## References

- [https://github.com/kishor-23/food-waste-management-system/](https://github.com/kishor-23/food-waste-management-system/)
- [https://github.com/kishor-23/food-waste-management-system/issues/9](https://github.com/kishor-23/food-waste-management-system/issues/9)

## Related threats

- [kishor-23 food-waste-management-system session fixation in login](https://junglewise.ai/threats/cve-2026-105233-a-vulnerability-has-been-found-in-kishor-23-food-waste)
- [food-waste-management-system SQL injection in registration page](https://junglewise.ai/threats/cve-2026-105232-a-flaw-has-been-found-in-kishor-23-food-waste-management-system)
- [Food Waste Management System SQL injection in admin registration](https://junglewise.ai/threats/cve-2026-105231-a-vulnerability-was-detected-in-kishor-23-food-waste-management)
- [food-waste-management-system SQL injection in delivery order handling](https://junglewise.ai/threats/cve-2026-105230-a-security-vulnerability-has-been-detected-in-kishor-23-food)
- [kishor-23 food-waste-management-system SQL injection in signup.php](https://junglewise.ai/threats/cve-2026-105229-a-weakness-has-been-identified-in-kishor-23-food-waste)