A vulnerability in the Order Assignment Block of kishor-23 food-waste-management-system allows an attacker to inject arbitrary SQL through the order_id and delivery_person_id parameters. This remote SQL injection can enable the attacker to read, modify or delete database contents, potentially leading to data leakage, tampering, or privilege escalation within the web application.

The affected component is admin/admin.php in the Order Assignment Block of kishor-23 food-waste-management-system. No specific version numbers are available because the project uses a rolling release model and no fixed release incorporates the fix.

The CVSS score of 5.3 indicates a medium severity vulnerability. The EPSS score is not available, so the current exploitation probability is uncertain, but the public nature of the exploit suggests it could be used. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the vulnerable code remotely via the web interface by manipulating order_id and delivery_person_id query arguments.