EIP-2026-105752

This PHP script exploits a predictable database backup filename vulnerability in Cart Engine 3.0.0, allowing unauthorized disclosure of sensitive database backups stored in the '/admin/backup' directory. It brute-forces possible filenames and checks for their existence via HTTP requests.