CVE-2026-112088 Details
Description
A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This affects the function mysqli_query of the file farmers/add.php. Executing a manipulation of the argument f_no/f_id/f_name/f_locallity/f_ac/f_phone can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure.
A SQL injection vulnerability has been identified in the Dav-ee Dairy Management System, specifically in the farmers module within the 'add.php', 'edit.php', and 'validate.php' files. The issue arises because the application concatenates user-supplied data from several POST fields directly into SQL queries without proper sanitization or parameterization. This vulnerability allows authenticated users, including those with the lowest privileges, to manipulate SQL queries and potentially read or modify database records. The application connects to the database as 'root', which could lead to broader database-level access.
The vulnerability can be addressed by replacing the affected SQL queries with prepared statements or parameterized queries, which properly handle user input and prevent SQL injection. Additionally, implementing role-based access controls in 'farmers/add.php' would prevent low-privilege users from accessing vulnerable functionalities.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Dav-ee/dairy-management-system/ | [email protected] | ProductVendor |
| https://github.com/Dav-ee/dairy-management-system/issues/2 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-112088 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1011414 | [email protected] | Permission Required |
| https://vuldb.com/vuln/421853 | [email protected] | Permission Required |
| https://vuldb.com/vuln/421853/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dav-ee dairy-management-system | f31a584c3330c013b61f8b0306d9e0849c6d693d |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |