The admin signup component of the food‑waste‑management‑system processes user‑supplied email, username, and location values directly in SQL statements without sanitization or parameterization. This results in two related weaknesses: improper handling of user input (CWE‑74) and injection of SQL code (CWE‑89). An attacker can craft malicious values that cause the application to execute arbitrary SQL commands, allowing them to read, modify, or delete data stored in the database, effectively enabling data exfiltration or unauthorized system changes.

The affected product is an open‑source food‑waste‑management‑system maintained by kishor‑23, hosted on GitHub. Because the project follows a rolling release model, version numbers for the vulnerable code are not explicitly documented, but the issue is present in the admin/signup.php file of the source tree referenced in the disclosure.

The flaw carries a CVSS base score of 6.9, indicating medium severity. No EPSS score is available, but a publicly known exploit exists and the vulnerability can be triggered remotely via the signup endpoint, even from unauthenticated users. While it is not listed in the CISA KEV catalog, the open‑source nature and public visibility of the code make it a high‑priority concern for organizations deploying this system.