Which versions of Pizzafy Ecommerce System are affected by CVE-2026-7225?

SourceCodester Pizzafy Ecommerce System 1.0 contains a critical SQL injection vulnerability in its administrative backend that allows unauthenticated remote attackers to extract databases, bypass…

Is there a public PoC exploit available for CVE-2026-7225?

Yes, a public proof-of-concept exploit is available for CVE-2026-7225. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7225?

Within 24 hours: Inventory all systems running SourceCodester Pizzafy Ecommerce 1.0 and immediately restrict network access to /admin/ajax.php via firewall or WAF rules, blocking all non-administrative IP ranges. Within 7 days: Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the ID parameter of the delete_menu function; consider deploying input validation/parameterized query middleware if available. Within 30 days: Contact SourceCodester for patch availability; if no patch is released, evaluate migration to an alternative ecommerce platform or implement compensating application-level controls such as stored procedures with parameterized queries and database-level least-privilege access controls.

Pizzafy Ecommerce System CVE-2026-7225

Q: What is the CVSS score of CVE-2026-7225?

CVE-2026-7225 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25989 MEDIUM

SQL Injection (CWE-89)

2026-04-28 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 28, 2026 - 06:22 NVD

HIGH MEDIUM

CVSS changed

Apr 28, 2026 - 06:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 28, 2026 - 06:01 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 05:30 euvd

EUVD-2026-25989

Analysis Generated

Apr 28, 2026 - 05:30 vuln.today

CVE Published

Apr 28, 2026 - 04:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function delete_menu of the file /admin/ajax.php?action=delete_menu. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in the delete_menu function of /admin/ajax.php. Public exploit code is available on GitHub, enabling database extraction, authentication bypass, and potential administrative access. CVSS 7.3 reflects network-accessible attack with no authentication required, though actual exploitation targets the administrative backend endpoint.

Technical ContextAI

This vulnerability exploits CWE-89 (SQL Injection) in a PHP-based ecommerce application. The delete_menu function in /admin/ajax.php lacks proper input sanitization on the ID parameter, allowing attackers to inject malicious SQL syntax into database queries. The affected product (cpe:2.3:a:sourcecodester:pizzafy_ecommerce_system) is a SourceCodester open-source project commonly used for educational purposes and small business deployments. SQL injection occurs when user-controllable input is concatenated directly into SQL statements without parameterized queries or adequate escaping, enabling attackers to manipulate database logic, extract sensitive data, modify records, or escalate privileges within the application.

RemediationAI

No vendor-released patch identified at time of analysis for SourceCodester Pizzafy Ecommerce System 1.0, as this is an open-source educational project without formal security update channels. Immediate mitigation requires manual code modification: implement parameterized queries (prepared statements) in /admin/ajax.php for the delete_menu function, specifically binding the ID parameter using PDO or mysqli prepared statement APIs rather than direct string concatenation. Compensating controls include restricting access to /admin/ajax.php endpoints via IP allowlisting to trusted administrative networks only, implementing a web application firewall (WAF) with SQL injection signature detection (trade-off: may produce false positives requiring tuning, and bypass techniques exist), and enforcing strong authentication on all /admin/ paths with multi-factor authentication to reduce unauthenticated access surface despite the PR:N vector rating. Conduct thorough code audit of all AJAX endpoints and database interaction points for similar unsanitized input handling. Consider migrating to actively maintained ecommerce platforms with dedicated security teams if this system is used in production environments. Advisory references: https://vuldb.com/vuln/359825 and exploit details at https://github.com/fernando-mengali/vulndb-submissions/blob/main/02-vul-SQLI.md.