The vulnerability is located in an unknown function within admin/donate.php of the food-waste-management-system. By manipulating the argument named location, an attacker can construct a malicious payload that is passed straight to a database query, enabling arbitrary SQL execution. This flaw can lead to unauthorized data disclosure, data modification, or potentially full database compromise, depending on the database permissions granted to the application.

The affected product is the Kishor-23 Food Waste Management System, a web application maintained in a rolling-release model. Because the project does not publish explicit version numbers for releases, it is unclear which commits are affected; however, the vulnerability is present in the code identified by the commit hashes 411989e3ecb82895e53dca7865f72145f03d7d93 and b3a70b2c492dc9904de5be1ad9389bd79b87f82c.

The flaw is exploitable remotely, as the attacker can supply the malicious input via a web request. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, indicating limited documented exploitation. Nonetheless, the CVSS score of 6.9 signals moderate risk, and the publicly disclosed exploit details raise the likelihood that an attacker could build a proof‑of‑concept quickly. Administrators should assume a potential attack vector from external hosts unless access controls are in place.