{"id":"CVE-2026-112089","kind":"vulnerability","aliases":["CVE-2026-112089"],"related":[],"title":"Dairy-management-system: SQL injection in employee delete page lets remote attackers query the database","description":"A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This vulnerability affects the function mysqli_query of the file employees/delete.php. The manipulation of the argument e_payroll_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The Dav-ee dairy-management-system has an SQL injection flaw in employees/delete.php, where the e_payroll_no argument is passed unsafely to mysqli_query. A remote attacker can alter database queries to read or change stored data, and a public exploit has been disclosed.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dairy-management-system","mysql","other","php","self-hosted"],"not_affected_if":["endpoint-not-reachable","not-deployed"],"how_to_check":"- Check whether employees/delete.php exists in your deployment of dairy-management-system and whether it passes e_payroll_no straight into a mysqli_query call\n- Look at the git commit in your deployment (unknown if the sources list a fixed commit)","fix":"- unknown: the project has not responded and the sources give no fixed version\n- Restrict access to employees/delete.php at the web server or network level until a fix exists\n- Replace the query with a prepared statement that binds e_payroll_no as a parameter","status":"open","published_at":"2026-10-19T07:16:31+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:10:19+00:00","updated_at":"2026-10-25T04:10:19+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:10:19Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the project has not responded and the sources give no fixed version\n- Restrict access to employees/delete.php at the web server or network level until a fix exists\n- Replace the query with a prepared statement that binds e_payroll_no as a parameter","reach":"internet","title":"Dairy-management-system: SQL injection in employee delete page lets remote attackers query the database","impact":"medium","summary":"The Dav-ee dairy-management-system has an SQL injection flaw in employees/delete.php, where the e_payroll_no argument is passed unsafely to mysqli_query. A remote attacker can alter database queries to read or change stored data, and a public exploit has been disclosed.","category":"other","nicknames":[],"who_cares":["php","mysql","self-hosted","dairy-management-system"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or modifies database records remotely through the injected query","analyst_note":"Confirm whether the endpoint requires login and find a fixed commit or workaround; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112089 and the project's issue tracker.","how_to_check":"- Check whether employees/delete.php exists in your deployment of dairy-management-system and whether it passes e_payroll_no straight into a mysqli_query call\n- Look at the git commit in your deployment (unknown if the sources list a fixed commit)","needs_analyst":true,"not_affected_if":["not-deployed","endpoint-not-reachable"],"who_is_affected":"Any installation of the Dav-ee dairy-management-system running the affected commit that exposes employees/delete.php to the network is potentially exposed. The sources do not say which configurations or roles are required, and the product has no versioned releases to compare against.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":3428,"output_tokens":653,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112089':19A,22A '-2026':18A,21A '31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d':94C 'affect':97C,152C 'alter':64B 'argument':53B,110C 'attack':13A,62B,119C 'avail':158C 'chang':70B 'continu':143C 'cve':17A,20A 'dairi':2A,24B,38B,91C 'dairy-management-system':1A,23B,37B,90C 'data':72B 'databas':16A,65B 'dav':35B,88C 'dav-e':34B,87C 'delet':9A 'deliv':142C 'detect':85C 'disclos':79B,128C 'e':50B,111C 'earli':166C 'ee':36B,89C 'employe':8A 'employees/delete.php':47B,105C 'exploit':76B,125C 'file':104C 'flaw':45B 'function':99C 'host':32B 'inform':150C,162C 'initi':122C 'inject':6A,44B,117C 'issu':169C 'lead':114C 'let':11A 'manag':3A,25B,39B,92C 'manipul':107C 'may':120C,131C 'model':140C 'mysql':27B 'mysqli':58B,100C 'page':10A 'pass':55B 'payrol':51B,112C 'php':29B 'problem':165C 'product':135C 'project':160C 'public':75B,129C 'queri':14A,59B,66B,101C 'read':68B 'releas':139C,155C 'remot':12A,61B,123C 'report':170C 'respond':174C 'result':147C 'roll':138C 'secur':81C 'self':31B 'self-host':30B 'specif':148C 'sql':5A,43B,116C 'store':71B 'system':4A,26B,40B,93C 'unsaf':56B 'updat':144C,154C 'use':133C,136C 'version':149C 'vulner':82C,96C 'yet':175C","nicknames":[],"mitigations":[],"who_affected":"Any installation of the Dav-ee dairy-management-system running the affected commit that exposes employees/delete.php to the network is potentially exposed. The sources do not say which configurations or roles are required, and the product has no versioned releases to compare against.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T07:16:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112089","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112089","severity":null,"published_at":"2026-10-19T07:16:31+00:00","modified_at":"2026-10-19T17:17:11+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}