Pizzafy Ecommerce System
Monthly
Unrestricted file upload in SourceCodester Pizzafy Ecommerce System 1.0 exposes the admin panel's `save_settings` function to arbitrary file upload via the `img` parameter in `/admin/admin_class_novo.php`. The CVSS 4.0 vector (PR:H) confirms exploitation requires authenticated administrator-level access, but once achieved, a PHP webshell can be uploaded to the server and potentially executed, escalating effective impact well beyond the base score's conservative VC:L/VI:L ratings. No public exploit code and no CISA KEV listing exist at time of analysis.
Local File Inclusion via null byte injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers with low-privilege accounts to read arbitrary files from the server by manipulating the `page` parameter in `/index.php`. Publicly available exploit code exists, published as a GitHub writeup demonstrating the null byte (%00) bypass technique. No CISA KEV listing at time of analysis, but the public POC lowers the bar for targeted exploitation against low-security PHP deployments.
File inclusion in SourceCodester Pizzafy Ecommerce System 1.0 exposes the admin panel to path traversal attacks via the `page` parameter in `/admin/index.php`, enabling an authenticated remote attacker to include arbitrary server-side files. Successful exploitation yields low-impact confidentiality, integrity, and availability compromise consistent with the CVSS C:L/I:L/A:L rating. A public exploit writeup (POC) exists on GitHub, significantly lowering the skill threshold for exploitation; however, no active exploitation has been confirmed via CISA KEV at time of analysis.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the pid parameter in /admin/ajax.php?action=add_to_cart, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has publicly available exploit code and may be actively exploited.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers with high privileges to manipulate the save_user function in /admin/ajax.php via crafted input, enabling data exfiltration and modification. The vulnerability requires administrative credentials, has publicly available exploit code, and poses moderate risk (CVSS 4.7) primarily to systems where admin accounts are compromised or weak.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated high-privilege attackers to manipulate the save_menu function via the /admin/ajax.php endpoint, enabling database queries with limited confidentiality and integrity impact. The vulnerability requires administrative credentials and carries a moderate CVSS score of 4.7; publicly available exploit code exists but active exploitation at scale has not been confirmed.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated high-privilege users to manipulate the save_settings function via the /pizzafy/admin/ajax.php endpoint, enabling database query modification with confidentiality, integrity, and availability impact. The vulnerability requires high-level authentication and is not remotely exploitable by unauthenticated attackers despite network-accessible endpoint; publicly available exploit code exists and the vulnerability has been disclosed.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated admin users to manipulate the `id` GET parameter in `/admin/view_order.php`, executing arbitrary SQL queries against the backend database. A proof-of-concept exploit has been publicly disclosed on GitHub, though EPSS sits at just 0.03% (8th percentile) and no CISA KEV listing exists, indicating minimal observed exploitation activity. The CVSS 4.0 score of 2.0 with PR:H reflects the significant barrier of requiring valid admin credentials prior to exploitation.
Unrestricted file upload in Pizzafy Ecommerce System 1.0 allows authenticated administrators to upload arbitrary PHP files via the `img` argument in the `save_menu` function of `/admin/admin_class_novo.php`, leading to remote code execution on the server. A public proof-of-concept on GitHub explicitly demonstrates the complete exploit chain from file upload to RCE. No public exploitation has been confirmed in CISA KEV, and EPSS at 0.03% reflects negligible real-world targeting, consistent with the product's obscure deployment footprint and the PR:H authentication barrier.
Stored/reflected cross-site scripting in SourceCodester Pizzafy Ecommerce System 1.0 allows an authenticated administrator to inject arbitrary JavaScript via the Name parameter at /admin/ajax.php?action=save_menu, which executes in the browser of any user who subsequently loads the manipulated menu. A public proof-of-concept is documented in a researcher-submitted PDF on GitHub, though no active exploitation has been confirmed and EPSS sits at 0.03% (9th percentile). The CVSS 4.0 score of 1.9 correctly reflects the high privilege bar and required user interaction, making this a low-priority, researcher-reported finding with minimal real-world risk in typical deployments.
Cross-site scripting (XSS) in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated high-privilege administrators to inject malicious scripts via the Name parameter in the /admin/index.php?page=save_settings endpoint, exploited when an admin visits a crafted link. The vulnerability requires high privilege level (admin) and user interaction (UI:P), limiting but not eliminating real-world risk in environments with untrusted admins or admin account compromise. Publicly available exploit code exists.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in the delete_category function (/admin/ajax.php?action=delete_category). The vulnerability requires high-privilege authentication but enables limited confidentiality and integrity impact. Publicly available exploit code exists, elevating real-world risk despite the moderate CVSS score of 5.1.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Name parameter in the save_category function at /admin/ajax.php. The vulnerability requires valid administrative credentials but poses moderate confidentiality, integrity, and availability risk. Publicly available exploit code exists and EPSS score of 0.84 indicates high exploitation probability despite the authentication gate.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 via the ID parameter in /view_prod.php allows authenticated remote attackers to execute arbitrary SQL queries with low complexity and no user interaction required. The vulnerability has a publicly available exploit and CVSS score of 6.3 reflecting moderate impact on confidentiality, integrity, and availability. Active exploitation is not yet confirmed in CISA KEV, but public proof-of-concept code exists.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in the save_order function at /admin/ajax.php?action=save_order, potentially enabling data exfiltration, modification, or deletion. Publicly available exploit code exists and the vulnerability carries a CVSS score of 6.3 with low complexity, indicating moderate real-world risk despite requiring login credentials.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to read, modify, or delete database contents through the ID parameter in the category function (pizza/index.php?page=category). The vulnerability has publicly available exploit code and requires valid user authentication to exploit, making it a moderate-risk issue suitable for immediate patching in production environments.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to manipulate the ID parameter in the get_cart_items AJAX function (/admin/ajax.php?action=get_cart_items) to execute arbitrary SQL queries and extract, modify, or delete database contents. The vulnerability has a CVSS score of 6.3 with publicly available exploit code, posing moderate risk to affected installations.
SQL injection in Pizzafy Ecommerce System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in the get_cart_count function at /admin/ajax.php. CVSS scores 7.3 (High) with network attack vector, low complexity, and no authentication required. Public exploit code exists on GitHub, significantly lowering the barrier to exploitation. EPSS data not available, but the combination of public exploit, low attack complexity (AC:L), and no authentication (PR:N) indicates moderate-to-high real-world risk for internet-facing installations.
SQL injection in Pizzafy Ecommerce System 1.0 allows remote unauthenticated attackers to compromise database confidentiality, integrity, and availability via the email parameter in the admin login function. The vulnerability exists in /admin/ajax.php?action=login and has a publicly available proof-of-concept exploit on GitHub. With CVSS 7.3 (High) and confirmed POC, this represents an immediate risk to internet-exposed admin panels, though no active exploitation has been confirmed by CISA KEV at time of analysis.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows remote unauthenticated attackers to compromise database confidentiality, integrity, and availability through the login2 function. The vulnerability exists in /admin/ajax.php when processing the email parameter during administrative login, enabling attackers to bypass authentication, extract sensitive data, modify records, or disrupt service. A proof-of-concept exploit has been publicly released on GitHub, significantly lowering the barrier to exploitation. CVSS 7.3 (High) reflects network-accessible attack surface with no authentication required and low attack complexity.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in the delete_menu function of /admin/ajax.php. Public exploit code is available on GitHub, enabling database extraction, authentication bypass, and potential administrative access. CVSS 7.3 reflects network-accessible attack with no authentication required, though actual exploitation targets the administrative backend endpoint.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the ID parameter in /admin/ajax.php?action=delete_cart endpoint. Publicly available exploit code exists (GitHub POC), enabling immediate weaponization. CVSS 7.3 indicates network-based exploitation with no authentication barriers, granting partial confidentiality, integrity, and availability impact. Despite high CVSS and public POC, this affects a niche open-source e-commerce platform with limited deployment footprint.
Unrestricted file upload in SourceCodester Pizzafy Ecommerce System 1.0 exposes the admin panel's `save_settings` function to arbitrary file upload via the `img` parameter in `/admin/admin_class_novo.php`. The CVSS 4.0 vector (PR:H) confirms exploitation requires authenticated administrator-level access, but once achieved, a PHP webshell can be uploaded to the server and potentially executed, escalating effective impact well beyond the base score's conservative VC:L/VI:L ratings. No public exploit code and no CISA KEV listing exist at time of analysis.
Local File Inclusion via null byte injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers with low-privilege accounts to read arbitrary files from the server by manipulating the `page` parameter in `/index.php`. Publicly available exploit code exists, published as a GitHub writeup demonstrating the null byte (%00) bypass technique. No CISA KEV listing at time of analysis, but the public POC lowers the bar for targeted exploitation against low-security PHP deployments.
File inclusion in SourceCodester Pizzafy Ecommerce System 1.0 exposes the admin panel to path traversal attacks via the `page` parameter in `/admin/index.php`, enabling an authenticated remote attacker to include arbitrary server-side files. Successful exploitation yields low-impact confidentiality, integrity, and availability compromise consistent with the CVSS C:L/I:L/A:L rating. A public exploit writeup (POC) exists on GitHub, significantly lowering the skill threshold for exploitation; however, no active exploitation has been confirmed via CISA KEV at time of analysis.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the pid parameter in /admin/ajax.php?action=add_to_cart, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has publicly available exploit code and may be actively exploited.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers with high privileges to manipulate the save_user function in /admin/ajax.php via crafted input, enabling data exfiltration and modification. The vulnerability requires administrative credentials, has publicly available exploit code, and poses moderate risk (CVSS 4.7) primarily to systems where admin accounts are compromised or weak.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated high-privilege attackers to manipulate the save_menu function via the /admin/ajax.php endpoint, enabling database queries with limited confidentiality and integrity impact. The vulnerability requires administrative credentials and carries a moderate CVSS score of 4.7; publicly available exploit code exists but active exploitation at scale has not been confirmed.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated high-privilege users to manipulate the save_settings function via the /pizzafy/admin/ajax.php endpoint, enabling database query modification with confidentiality, integrity, and availability impact. The vulnerability requires high-level authentication and is not remotely exploitable by unauthenticated attackers despite network-accessible endpoint; publicly available exploit code exists and the vulnerability has been disclosed.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated admin users to manipulate the `id` GET parameter in `/admin/view_order.php`, executing arbitrary SQL queries against the backend database. A proof-of-concept exploit has been publicly disclosed on GitHub, though EPSS sits at just 0.03% (8th percentile) and no CISA KEV listing exists, indicating minimal observed exploitation activity. The CVSS 4.0 score of 2.0 with PR:H reflects the significant barrier of requiring valid admin credentials prior to exploitation.
Unrestricted file upload in Pizzafy Ecommerce System 1.0 allows authenticated administrators to upload arbitrary PHP files via the `img` argument in the `save_menu` function of `/admin/admin_class_novo.php`, leading to remote code execution on the server. A public proof-of-concept on GitHub explicitly demonstrates the complete exploit chain from file upload to RCE. No public exploitation has been confirmed in CISA KEV, and EPSS at 0.03% reflects negligible real-world targeting, consistent with the product's obscure deployment footprint and the PR:H authentication barrier.
Stored/reflected cross-site scripting in SourceCodester Pizzafy Ecommerce System 1.0 allows an authenticated administrator to inject arbitrary JavaScript via the Name parameter at /admin/ajax.php?action=save_menu, which executes in the browser of any user who subsequently loads the manipulated menu. A public proof-of-concept is documented in a researcher-submitted PDF on GitHub, though no active exploitation has been confirmed and EPSS sits at 0.03% (9th percentile). The CVSS 4.0 score of 1.9 correctly reflects the high privilege bar and required user interaction, making this a low-priority, researcher-reported finding with minimal real-world risk in typical deployments.
Cross-site scripting (XSS) in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated high-privilege administrators to inject malicious scripts via the Name parameter in the /admin/index.php?page=save_settings endpoint, exploited when an admin visits a crafted link. The vulnerability requires high privilege level (admin) and user interaction (UI:P), limiting but not eliminating real-world risk in environments with untrusted admins or admin account compromise. Publicly available exploit code exists.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in the delete_category function (/admin/ajax.php?action=delete_category). The vulnerability requires high-privilege authentication but enables limited confidentiality and integrity impact. Publicly available exploit code exists, elevating real-world risk despite the moderate CVSS score of 5.1.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Name parameter in the save_category function at /admin/ajax.php. The vulnerability requires valid administrative credentials but poses moderate confidentiality, integrity, and availability risk. Publicly available exploit code exists and EPSS score of 0.84 indicates high exploitation probability despite the authentication gate.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 via the ID parameter in /view_prod.php allows authenticated remote attackers to execute arbitrary SQL queries with low complexity and no user interaction required. The vulnerability has a publicly available exploit and CVSS score of 6.3 reflecting moderate impact on confidentiality, integrity, and availability. Active exploitation is not yet confirmed in CISA KEV, but public proof-of-concept code exists.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in the save_order function at /admin/ajax.php?action=save_order, potentially enabling data exfiltration, modification, or deletion. Publicly available exploit code exists and the vulnerability carries a CVSS score of 6.3 with low complexity, indicating moderate real-world risk despite requiring login credentials.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to read, modify, or delete database contents through the ID parameter in the category function (pizza/index.php?page=category). The vulnerability has publicly available exploit code and requires valid user authentication to exploit, making it a moderate-risk issue suitable for immediate patching in production environments.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to manipulate the ID parameter in the get_cart_items AJAX function (/admin/ajax.php?action=get_cart_items) to execute arbitrary SQL queries and extract, modify, or delete database contents. The vulnerability has a CVSS score of 6.3 with publicly available exploit code, posing moderate risk to affected installations.
SQL injection in Pizzafy Ecommerce System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in the get_cart_count function at /admin/ajax.php. CVSS scores 7.3 (High) with network attack vector, low complexity, and no authentication required. Public exploit code exists on GitHub, significantly lowering the barrier to exploitation. EPSS data not available, but the combination of public exploit, low attack complexity (AC:L), and no authentication (PR:N) indicates moderate-to-high real-world risk for internet-facing installations.
SQL injection in Pizzafy Ecommerce System 1.0 allows remote unauthenticated attackers to compromise database confidentiality, integrity, and availability via the email parameter in the admin login function. The vulnerability exists in /admin/ajax.php?action=login and has a publicly available proof-of-concept exploit on GitHub. With CVSS 7.3 (High) and confirmed POC, this represents an immediate risk to internet-exposed admin panels, though no active exploitation has been confirmed by CISA KEV at time of analysis.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows remote unauthenticated attackers to compromise database confidentiality, integrity, and availability through the login2 function. The vulnerability exists in /admin/ajax.php when processing the email parameter during administrative login, enabling attackers to bypass authentication, extract sensitive data, modify records, or disrupt service. A proof-of-concept exploit has been publicly released on GitHub, significantly lowering the barrier to exploitation. CVSS 7.3 (High) reflects network-accessible attack surface with no authentication required and low attack complexity.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in the delete_menu function of /admin/ajax.php. Public exploit code is available on GitHub, enabling database extraction, authentication bypass, and potential administrative access. CVSS 7.3 reflects network-accessible attack with no authentication required, though actual exploitation targets the administrative backend endpoint.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the ID parameter in /admin/ajax.php?action=delete_cart endpoint. Publicly available exploit code exists (GitHub POC), enabling immediate weaponization. CVSS 7.3 indicates network-based exploitation with no authentication barriers, granting partial confidentiality, integrity, and availability impact. Despite high CVSS and public POC, this affects a niche open-source e-commerce platform with limited deployment footprint.