SQL Injection in SourceCodester Pizzafy Ecommerce System

Executive Summary

CVE-2026-7410 is a SQL Injection vulnerability found in the Pizzafy Ecommerce System 1.0, specifically in the /pizza/admin/ajax.php?action=add_to_cart endpoint.

The vulnerability occurs because the pid parameter in the POST request is not properly sanitized or validated before being used in SQL queries. This allows an attacker to inject malicious SQL code.

Exploiting this vulnerability can enable attackers to enumerate database tables, extract sensitive information such as usernames and password hashes, modify or delete records, and escalate privileges by accessing session-related data.

The root cause is the direct interpolation of user input into SQL queries without using prepared statements or parameterized inputs.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending specially crafted POST requests to the /pizza/admin/ajax.php?action=add_to_cart endpoint, targeting the pid parameter to test for SQL injection.

A common detection method involves injecting SQL syntax into the pid parameter and observing error messages or unusual responses that indicate SQL query manipulation.

For example, you can use curl to send a test request that attempts to trigger a database error using the extractvalue function:

• curl -X POST -d "pid=1' and extractvalue(1,concat(0x7e,(select database()),0x7e))-- -" http://<target>/pizza/admin/ajax.php?action=add_to_cart

If the response contains database error messages or reveals database names, it confirms the presence of the SQL injection vulnerability.

Useful 0 Not Useful 0

Impact Analysis

The SQL injection vulnerability can allow an attacker to manipulate the database queries executed by the application. This can lead to unauthorized access to sensitive data, data modification, or even deletion.

Since the attack can be performed remotely, it increases the risk of exploitation without requiring physical access to the system.

The CVSS v3.1 score of 6.3 indicates a medium severity impact, meaning the vulnerability can cause limited confidentiality, integrity, and availability impacts.

Useful 0 Not Useful 0

Compliance Impact

The SQL injection vulnerability in SourceCodester Pizzafy Ecommerce System 1.0 allows attackers to extract sensitive data such as usernames and password hashes, modify or delete records, and escalate privileges by accessing session-related data.

Such unauthorized access and potential data breaches can lead to non-compliance with common standards and regulations like GDPR and HIPAA, which mandate the protection of personal and sensitive information.

Failure to properly secure user data and prevent unauthorized access may result in violations of these regulations, potentially causing legal and financial consequences for affected organizations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves fixing the SQL injection vulnerability by replacing direct SQL queries with prepared statements using parameterized inputs.

Ensure proper sanitization and validation of the pid parameter to prevent malicious input from being executed as SQL.

• Apply the provided fix that uses prepared statements to safely handle the pid parameter.
• Restrict access to the /pizza/admin/ajax.php?action=add_to_cart endpoint to trusted users or IP addresses if possible.
• Monitor logs for suspicious activity related to the add_to_cart action.
• Update the system to the latest patched version once available.

Useful 0 Not Useful 0