Directory traversal vulnerability in Online Catering Reservation System 1.0 exists due to lack of validation in index.php.