Pizzafy Ecommerce System
Monthly
Unrestricted file upload in SourceCodester Pizzafy Ecommerce System 1.0 exposes the admin panel's `save_settings` function to arbitrary file upload via the `img` parameter in `/admin/admin_class_novo.php`. The CVSS 4.0 vector (PR:H) confirms exploitation requires authenticated administrator-level access, but once achieved, a PHP webshell can be uploaded to the server and potentially executed, escalating effective impact well beyond the base score's conservative VC:L/VI:L ratings. No public exploit code and no CISA KEV listing exist at time of analysis.
Local File Inclusion via null byte injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers with low-privilege accounts to read arbitrary files from the server by manipulating the `page` parameter in `/index.php`. Publicly available exploit code exists, published as a GitHub writeup demonstrating the null byte (%00) bypass technique. No CISA KEV listing at time of analysis, but the public POC lowers the bar for targeted exploitation against low-security PHP deployments.
File inclusion in SourceCodester Pizzafy Ecommerce System 1.0 exposes the admin panel to path traversal attacks via the `page` parameter in `/admin/index.php`, enabling an authenticated remote attacker to include arbitrary server-side files. Successful exploitation yields low-impact confidentiality, integrity, and availability compromise consistent with the CVSS C:L/I:L/A:L rating. A public exploit writeup (POC) exists on GitHub, significantly lowering the skill threshold for exploitation; however, no active exploitation has been confirmed via CISA KEV at time of analysis.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated admin users to manipulate the `id` GET parameter in `/admin/view_order.php`, executing arbitrary SQL queries against the backend database. A proof-of-concept exploit has been publicly disclosed on GitHub, though EPSS sits at just 0.03% (8th percentile) and no CISA KEV listing exists, indicating minimal observed exploitation activity. The CVSS 4.0 score of 2.0 with PR:H reflects the significant barrier of requiring valid admin credentials prior to exploitation.
Unrestricted file upload in Pizzafy Ecommerce System 1.0 allows authenticated administrators to upload arbitrary PHP files via the `img` argument in the `save_menu` function of `/admin/admin_class_novo.php`, leading to remote code execution on the server. A public proof-of-concept on GitHub explicitly demonstrates the complete exploit chain from file upload to RCE. No public exploitation has been confirmed in CISA KEV, and EPSS at 0.03% reflects negligible real-world targeting, consistent with the product's obscure deployment footprint and the PR:H authentication barrier.
Stored/reflected cross-site scripting in SourceCodester Pizzafy Ecommerce System 1.0 allows an authenticated administrator to inject arbitrary JavaScript via the Name parameter at /admin/ajax.php?action=save_menu, which executes in the browser of any user who subsequently loads the manipulated menu. A public proof-of-concept is documented in a researcher-submitted PDF on GitHub, though no active exploitation has been confirmed and EPSS sits at 0.03% (9th percentile). The CVSS 4.0 score of 1.9 correctly reflects the high privilege bar and required user interaction, making this a low-priority, researcher-reported finding with minimal real-world risk in typical deployments.
Unrestricted file upload in SourceCodester Pizzafy Ecommerce System 1.0 exposes the admin panel's `save_settings` function to arbitrary file upload via the `img` parameter in `/admin/admin_class_novo.php`. The CVSS 4.0 vector (PR:H) confirms exploitation requires authenticated administrator-level access, but once achieved, a PHP webshell can be uploaded to the server and potentially executed, escalating effective impact well beyond the base score's conservative VC:L/VI:L ratings. No public exploit code and no CISA KEV listing exist at time of analysis.
Local File Inclusion via null byte injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers with low-privilege accounts to read arbitrary files from the server by manipulating the `page` parameter in `/index.php`. Publicly available exploit code exists, published as a GitHub writeup demonstrating the null byte (%00) bypass technique. No CISA KEV listing at time of analysis, but the public POC lowers the bar for targeted exploitation against low-security PHP deployments.
File inclusion in SourceCodester Pizzafy Ecommerce System 1.0 exposes the admin panel to path traversal attacks via the `page` parameter in `/admin/index.php`, enabling an authenticated remote attacker to include arbitrary server-side files. Successful exploitation yields low-impact confidentiality, integrity, and availability compromise consistent with the CVSS C:L/I:L/A:L rating. A public exploit writeup (POC) exists on GitHub, significantly lowering the skill threshold for exploitation; however, no active exploitation has been confirmed via CISA KEV at time of analysis.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated admin users to manipulate the `id` GET parameter in `/admin/view_order.php`, executing arbitrary SQL queries against the backend database. A proof-of-concept exploit has been publicly disclosed on GitHub, though EPSS sits at just 0.03% (8th percentile) and no CISA KEV listing exists, indicating minimal observed exploitation activity. The CVSS 4.0 score of 2.0 with PR:H reflects the significant barrier of requiring valid admin credentials prior to exploitation.
Unrestricted file upload in Pizzafy Ecommerce System 1.0 allows authenticated administrators to upload arbitrary PHP files via the `img` argument in the `save_menu` function of `/admin/admin_class_novo.php`, leading to remote code execution on the server. A public proof-of-concept on GitHub explicitly demonstrates the complete exploit chain from file upload to RCE. No public exploitation has been confirmed in CISA KEV, and EPSS at 0.03% reflects negligible real-world targeting, consistent with the product's obscure deployment footprint and the PR:H authentication barrier.
Stored/reflected cross-site scripting in SourceCodester Pizzafy Ecommerce System 1.0 allows an authenticated administrator to inject arbitrary JavaScript via the Name parameter at /admin/ajax.php?action=save_menu, which executes in the browser of any user who subsequently loads the manipulated menu. A public proof-of-concept is documented in a researcher-submitted PDF on GitHub, though no active exploitation has been confirmed and EPSS sits at 0.03% (9th percentile). The CVSS 4.0 score of 1.9 correctly reflects the high privilege bar and required user interaction, making this a low-priority, researcher-reported finding with minimal real-world risk in typical deployments.