Executive brief
SourceCodester Pizzafy E-Commerce System, a web application for managing online pizza orders, contains a security flaw in its administrative order confirmation process. An attacker can exploit this to gain unauthorized access to the underlying database, potentially leading to the theft of customer information, tampering with order data, or disrupting business operations. No login credentials are required to perform this attack.
Technical details
A SQL injection vulnerability exists in SourceCodester Pizzafy E-Commerce System 1.0 within the 'confirm_order' action of /admin/ajax.php (which calls admin_class_novo.php). The 'id' parameter is used directly in a SQL query without proper sanitization or prepared statements. A remote, unauthenticated attacker can exploit this by sending a specially crafted POST request to execute arbitrary SQL commands. This can lead to unauthorized database access, data exfiltration, or modification of records. A public exploit (POC) involving a time-based blind SQL injection payload has been released.
Affected products
- SourceCodester Pizzafy E-Commerce System 1.0
Timeline
- 2026-06-03: disclosed: Vulnerability reported on GitHub by researcher Jiaqi Shi
- 2026-07-05: advisory: NVD/VulDB advisory published