Executive brief
A security vulnerability exists in the Pizzafy E-Commerce System, a platform used for managing online pizza sales. An attacker can exploit the administrative login page to gain unauthorized access to the database. This could lead to the theft of customer information, modification of website content, or disruption of business operations.
Technical details
A SQL injection vulnerability exists in SourceCodester Pizzafy E-Commerce System 1.0 within the Administrative Control Panel. The flaw is located in the Login function of the /admin/admin_class_novo.php file. Specifically, the 'Username' argument is not properly sanitized before being used in a database query. A remote, unauthenticated attacker can exploit this by sending a specially crafted web request to execute arbitrary SQL commands. This can result in authentication bypass, unauthorized data retrieval, or modification of the underlying database. A public exploit is currently available.
Affected products
- SourceCodester Pizzafy E-Commerce System 1.0
Timeline
- 2026-06-03: advisory: NVD publication date
- 2026-06-03: disclosed: Public exploit released