CVE-2024-2557 is a medium severity (CVSS 5.3) improper authorization flaw in kishor-23 Food Waste Management System 1.0. The /admin/admin.php page can be reached without the right authorization. The record lists no fixed version, so restrict access or change the code.
What's affected
kishor-23 Food Waste Management System 1.0, per the record's CPE data. The affected code is the /admin/admin.php file. The record classes the weakness as improper authorization.
The NVD record scores it 5.3 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, published 2024-03-17. The weakness is classed as CWE-285 (improper authorization) and CWE-863 (incorrect authorization).
The record names no fixed version and I found no vendor advisory in its references. The vendor was contacted early and did not respond, according to the record, so assume no patch exists until you confirm otherwise.
How to check if you're exposed
Check the version of the application you deployed. Then confirm the admin page's behaviour from the server side: open your own test copy in a private browser window without signing in and see whether /admin/admin.php returns content.
Search your web root for the file:
find /var/www -path '*admin/admin.php' 2>/dev/null
What to do now
- Find every instance of the product and note who can reach it.
- Take it off untrusted networks until it is fixed or replaced.
- Apply the vendor or upstream fix if one exists. The record does not confirm one.
- If no fix exists, change the code yourself using the guidance under Why it matters and test it.
- Check web server and application logs for unexpected requests to /admin/admin.php.
Why it matters
The weakness is improper authorization. The page is reachable and does its work without confirming that the caller holds the role the function needs. A signed-out user, or a low-privilege user, can reach an administrative function directly by requesting its address.
The fix is to enforce authorization on the server for every protected page and action, based on the session identity, and to deny by default. Hiding links in the interface is not access control.
This CVE is not on the CISA Known Exploited Vulnerabilities list (the record's KEV flag is false). Exploit details are not repeated here, because this guide is about defence.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, and the Gold directory tracks this CVE. Reachability analysis helps decide which findings in your own code actually matter.
Quick check
Why is a 5.3 score marked critical in the advisory text?
The description text says the reporter classed it as critical, while the CVSS base score in the record is 5.3, which is medium. Both figures are in the sources, so weigh your own exposure rather than the label.
Sources
Last reviewed: 19 October 2026.
