SQL Injection in Food Waste Management Admin Panel

A vulnerability was determined in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file admin/donate.php. Executing a manipulation of the argument location can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability is a remote SQL injection flaw discovered in the kishor-23 food-waste-management-system, specifically within the admin/donate.php file. An attacker can manipulate the 'location' parameter to inject malicious SQL commands, potentially compromising the entire database. With a CVSS score of 7.3, this represents a high-severity threat affecting any organization or individual deploying this food waste management system. The vulnerability is particularly concerning because it impacts administrative functions, giving attackers potential access to sensitive operational data, user information, and system configurations. Since the exploit has been publicly disclosed, the attack surface is actively exploitable by both opportunistic and targeted threat actors.

Casky's platform maps this vulnerability across 323 security skills and detects the attack patterns through Claude AI's extended reasoning capabilities aligned with MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance). Practitioners using Casky would observe detection signals related to CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection), manifesting as suspicious parameter manipulation attempts and unexpected SQL query patterns in application logs. The platform's skill set enables detection of initial reconnaissance probes targeting the donate.php endpoint, followed by exploitation attempts using SQL metacharacters in the location parameter. Security teams would see findings highlighting the attack chain: initial reconnaissance of the vulnerable endpoint, crafted HTTP requests with injected SQL payloads, and anomalous database query execution patterns that deviate from legitimate administrative workflows.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-105167.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-105167

Casky has 323 skills that investigate the attack patterns behind CVE-2026-105167. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn