CVE-2026-10559

SourceCodester Pizzafy Ecommerce System index.php file inclusion

View on CVE.org
Published Jun 2, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is an unknown function of the file /index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be performed from remote. The exploit has been published and may be used.

Analysis

AI-generated

Technical impact

The flaw in SourceCodester Pizzafy Ecommerce System 1.0 arises from an unchecked handling of the 'page' argument in index.php, enabling file inclusion and allowing an attacker to inject arbitrary file paths. This can lead to disclosure of sensitive files or execution of malicious scripts, thereby compromising confidentiality, integrity, and potentially availability of the application. The weakness is classified as CWE-73.

Affected Systems

SourceCodester Pizzafy Ecommerce System version 1.0 is affected. No additional vendor or product versions are specified.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.3, indicating a moderate severity. While the EPSS score is not available, the published exploit and the possibility of remote exploitation suggest a realistic threat. The lack of a KEV listing does not diminish the likelihood that an attacker could leverage the flaw to include files from the server or external sources, posing a tangible risk to deployed instances.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s security patch that fixes the file‑inclusion flaw in index.php.
  • Enforce a strict whitelist or pattern check on the 'page' parameter so that only known, safe page names are accepted.
  • Disable external file inclusion in PHP by setting allow_url_fopen=Off and configuring the open_basedir restriction to limit file access to the application’s directory.
  • Ensure file permissions and web server configuration prevent execution of arbitrary scripts that could be dropped through the vulnerable inclusion mechanism.

Generated by OpenCVE AI on June 2, 2026 at 02:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is an unknown function of the file /index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be performed from remote. The exploit has been published and may be used.
Title SourceCodester Pizzafy Ecommerce System index.php file inclusion
First Time appeared Sourcecodester
Sourcecodester pizzafy Ecommerce System
Weaknesses CWE-73
CPEs cpe:2.3:a:sourcecodester:pizzafy_ecommerce_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester pizzafy Ecommerce System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-73

    External Control of File Name or Path

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jun 2, 2026, 3:45 PM
Reserved
Jun 1, 2026, 2:59 PM

View source JSON

Updated
Jun 2, 2026, 2:39 PM

JSON

Status
Deferred
Published
Jun 2, 2026, 2:16 AM
Modified
Jul 22, 2026, 7:10 PM

View source JSON

No data.

Updated
Jun 2, 2026, 2:30 AM

JSON