CVE-2026-112089
Received Received - Intake

SQL Injection in Dav-ee Dairy Management System

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This vulnerability affects the function mysqli_query of the file employees/delete.php. The manipulation of the argument e_payroll_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112089
EUVD
EUVD-2026-104094

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c
Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection flaw in the Dav-ee dairy-management-system. It exists in the employees/delete.php file where the e_payroll_no argument is improperly handled in the mysqli_query function. An attacker can manipulate this input to execute arbitrary SQL commands remotely.

Detection Guidance

To detect SQL injection vulnerabilities in the Dav-ee dairy-management-system, inspect the employees/delete.php file for improper input validation in the mysqli_query function. Look for direct use of user-supplied input like e_payroll_no without sanitization. Use tools like SQLmap to test for SQL injection by sending crafted payloads to the parameter.

Impact Analysis

This vulnerability allows remote attackers to execute unauthorized SQL commands on the database. This could lead to data theft, unauthorized modifications, or deletion of sensitive information stored in the system.

Compliance Impact

This SQL injection vulnerability could lead to unauthorized access, modification, or deletion of sensitive data, which may violate GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Unauthorized access to employee records could expose personal data, triggering compliance breaches under these regulations.

Mitigation Strategies

Immediately update the employees/delete.php file to use prepared statements with parameterized queries instead of direct mysqli_query calls. Validate and sanitize all user inputs, especially e_payroll_no. Restrict database user permissions to limit potential damage from SQL injection. Monitor network traffic for unusual database queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112089. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart