This vulnerability arises from an unknown functionality in the Database Backup Handler component of code-projects Simple Food Ordering System versions up to 1.0. By manipulating the /food/sql/food.sql resource, an attacker can access files or directories that should be restricted, enabling the retrieval of a database backup that may contain sensitive data. The resulting breach can expose user information, transactional records, or other confidential content, thereby compromising confidentiality and potentially integrity if data is altered.

The affected product is code-projects Simple Food Ordering System, version 1.0. The CPE 'carmelo:simple_food_order_system:1.0' indicates that any deployment of this open‑source application running that version is vulnerable. The flaw is present in the Database Backup Handler component of the application.

The CVSS score of 6.9 signifies moderate severity. The EPSS score of less than 1% suggests a low current exploitation probability, and the vulnerability is not listed in CISA's KEV catalog. Nevertheless, the attack can be performed remotely, meaning an adversary only needs network access to the web server. The potential impact of exposing a database backup makes the risk significant for systems that store sensitive user or business data.