A path traversal flaw exists in the configuration file /dbfood/localhost.sql of the Online Food Ordering System. By manipulating the file path, an attacker can read an arbitrary file or directory that should normally be inaccessible. This disclosure permits the attacker to obtain sensitive configuration data or user credentials, and it potentially allows further exploitation of the system. The weakness aligns with information exposure and path traversal characteristics.

The vulnerability affects the Online Food Ordering System 1.0, developed by code-projects. The flaw resides in an unspecified section of the localhost.sql file, and no other vendors or product versions are listed.

The severity score is 6.9 on the CVSS scale, indicating moderate risk, while the EPSS score is not available. It is not included in the CISA KEV catalog. The likely attack vector is remote, with an attacker able to send crafted web requests that trigger the traversal. Once exploited, the attacker can read arbitrary files, which could lead to privilege escalation or a broader compromise of the host. Publicly available exploit code has been referenced, increasing the realistic threat.