The flaw resides in the insert function of fooddonateform.php, where the image-choice input is inserted into a SQL query without proper sanitization. An attacker can supply malicious input that is incorporated verbatim into the database statement, allowing remote execution of arbitrary SQL. This can lead to confidentiality loss, manipulation or deletion of data, and potentially denial of service on the application or database. The weakness reflects CWE‑74 (Improper Parsing) and CWE‑89 (SQL Injection).

The vulnerable component is kishor‑23’s food‑waste‑management‑system, an open‑source web application hosted on GitHub. Because the project follows a rolling release strategy and does not expose discrete version numbers for the affected component, any active instance that has not been patched or updated may be impacted. No specific releases are marked vulnerable, so all users of the current repository code are potentially exposed.

The CVSS score of 6.9 indicates a moderate severity. EPSS is not available, but the vulnerability has a publicly available exploit, suggesting that attackers can already target this weakness remotely via the donation form. The lack of immediate vendor response and ongoing exposure mean that systems remain at risk until a patch or mitigated workaround is applied. The attack vector is remote, arising from a web form submission, and does not require privileged local access.