| Título | Code-Projects Simple Food Ordering System in PHP 1.0 Information Disclosure |
|---|
| Descrição | The Simple Food Ordering System in PHP contains a sensitive information disclosure vulnerability due to an exposed database backup file. The application stores a database dump file (food.sql) inside a publicly accessible directory within the web root. An attacker can directly access this file through the web server without authentication.
By visiting the exposed path /food/sql/food.sql, an attacker can download or view the full SQL database dump. The file contains database structure information and potentially sensitive data such as administrator accounts, usernames, password hashes, product information, and order records.
The issue exists because backup files are stored in the web-accessible directory and the server does not restrict access to .sql files. This misconfiguration allows unauthorized users to retrieve the database contents.
Successful exploitation may lead to sensitive data exposure, credential disclosure, and further attacks against the application using the leaked information |
|---|
| Fonte | ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Simple%20Food%20Ordering%20System%20Information%20Disclosure%20%20.md |
|---|
| Utilizador | AhmadMarzouk (UID 95993) |
|---|
| Submissão | 06/03/2026 23h42 (há 2 meses) |
|---|
| Moderação | 21/03/2026 08h56 (14 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 352320 [code-projects Simple Food Ordering System até 1.0 Database Backup /food/sql/food.sql Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|