{"id":"CVE-2026-112088","kind":"vulnerability","aliases":["CVE-2026-112088"],"related":[],"title":"Dav-ee dairy-management-system: SQL injection in farmers/add.php form fields","description":"A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This affects the function mysqli_query of the file farmers/add.php. Executing a manipulation of the argument f_no/f_id/f_name/f_locallity/f_ac/f_phone can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure.","summary":"The farmers/add.php page of the Dav-ee dairy management system passes form fields such as f_no, f_id, f_name and f_phone into a mysqli_query call without safe parameter binding. A remote attacker can alter the database queries to read or change stored farmer and dairy records.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dairy-management-system","package","php","self-hosted"],"not_affected_if":["no-internet-exposure","not-deployed"],"how_to_check":"- Look for `farmers/add.php` in the project and check whether the `mysqli_query` call builds SQL from `$_POST` or `$_GET` values without prepared statements\n- Confirm the commit in use: unknown versioning, compare against `31ace9692d1e1e6d64339a42c463b361319c615c` and `f31a584c3330c013b61f8b0306d9e0849c6d693d`","fix":null,"status":"open","published_at":"2026-10-19T07:16:30+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:57:22+00:00","updated_at":"2026-10-25T03:57:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:57:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Dav-ee dairy-management-system: SQL injection in farmers/add.php form fields","impact":"medium","summary":"The farmers/add.php page of the Dav-ee dairy management system passes form fields such as f_no, f_id, f_name and f_phone into a mysqli_query call without safe parameter binding. A remote attacker can alter the database queries to read or change stored farmer and dairy records.","category":"package","nicknames":[],"who_cares":["php","self-hosted","dairy-management-system"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or alters farm database records via injected SQL","analyst_note":"Check the NVD entry and the linked vendor disclosure for a fix commit, and confirm whether farmers/add.php requires login before the form is reachable.","how_to_check":"- Look for `farmers/add.php` in the project and check whether the `mysqli_query` call builds SQL from `$_POST` or `$_GET` values without prepared statements\n- Confirm the commit in use: unknown versioning, compare against `31ace9692d1e1e6d64339a42c463b361319c615c` and `f31a584c3330c013b61f8b0306d9e0849c6d693d`","needs_analyst":true,"not_affected_if":["not-deployed","no-internet-exposure"],"who_is_affected":"Any deployment of the Dav-ee dairy-management-system that exposes farmers/add.php to a network is exposed, since the flaw is reachable remotely through the form parameters. The sources do not give a fixed version, and the product does not use version numbers, so the affected range is unknown. Teams that do not run this code, or that keep the admin area off the internet, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":3424,"output_tokens":637,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112088':16A,19A '-2026':15A,18A '31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d':93C 'affect':95C,149C 'alter':67B 'argument':109C 'attack':65B,118C,137C 'avail':128C 'bind':62B 'call':58B 'chang':74B 'contact':158C 'could':133C 'cve':14A,17A 'dairi':5A,21B,37B,78B,90C 'dairy-management-system':4A,20B,89C 'databas':69B 'dav':2A,35B,87C 'dav-e':1A,34B,86C 'disclosur':162C 'earli':159C 'ee':3A,36B,88C 'execut':104C 'exploit':124C 'f':45B,47B,49B,52B,110C 'farmer':76B 'farmers/add.php':11A,30B,103C 'field':13A,42B 'file':102C 'form':12A,41B 'function':97C 'host':28B 'id':48B 'identifi':84C 'inform':147C 'inject':9A,116C 'launch':121C 'lead':113C 'made':127C 'manag':6A,22B,38B,91C 'manipul':106C 'mysqli':56B,98C 'name':50B 'no/f_id/f_name/f_locallity/f_ac/f_phone':111C 'packag':24B 'page':31B 'paramet':61B 'pass':40B 'phone':53B 'php':25B 'product':139C 'public':131C 'queri':57B,70B,99C 'read':72B 'record':79B 'releas':152C 'remot':64B,122C 'safe':60B 'self':27B 'self-host':26B 'sql':8A,115C 'store':75B 'system':7A,23B,39B,92C 'unaffect':151C 'unavail':154C 'use':135C,142C 'vendor':156C 'version':143C 'weak':81C 'without':59B","nicknames":[],"mitigations":[],"who_affected":"Any deployment of the Dav-ee dairy-management-system that exposes farmers/add.php to a network is exposed, since the flaw is reachable remotely through the form parameters. The sources do not give a fixed version, and the product does not use version numbers, so the affected range is unknown. Teams that do not run this code, or that keep the admin area off the internet, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T07:16:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112088","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112088","severity":null,"published_at":"2026-10-19T07:16:30+00:00","modified_at":"2026-10-19T17:17:11+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}