Executive brief
A vulnerability exists in the Pizzafy Ecommerce System, a platform used for managing online pizza sales. An attacker can exploit this flaw to access sensitive files on the server that should be restricted. This could lead to the exposure of configuration data, customer information, or system credentials, potentially allowing for a full takeover of the web server.
Technical details
A Local File Inclusion (LFI) vulnerability exists in SourceCodester Pizzafy Ecommerce System 1.0 due to insufficient validation of the 'page' GET parameter in /admin/index.php. The application passes user-supplied input directly into a PHP include() function, appending a .php extension but failing to filter directory traversal sequences (../). A remote attacker with low privileges (access to the admin panel) can exploit this to read arbitrary files on the host operating system or potentially achieve remote code execution if combined with other techniques like log poisoning. The vulnerability was confirmed on environments running PHP 8.2.12 and Apache 2.4.58.
Affected products
- SourceCodester Pizzafy Ecommerce System 1.0
Timeline
- 2026-06-02: advisory: NVD publication date
- 2026-06-01: disclosed: Initial disclosure by VulDB and researcher write-up