CVE-2026-7224

SourceCodester Pizzafy Ecommerce System ajax.php delete_cart sql injection

View on CVE.org
Published Apr 28, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A security flaw has been discovered in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function delete_cart of the file /admin/ajax.php?action=delete_cart. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

Analysis

AI-generated

Technical impact

SourceCodester Pizzafy Ecommerce System 1.0 allows an attacker to perform arbitrary SQL queries through the delete_cart endpoint by manipulating the ID parameter, which can compromise the database and lead to data disclosure, modification, or deletion.

Affected Systems

The vulnerability is present in SourceCodester Pizzafy Ecommerce System version 1.0. No other affected versions are listed.

Risk and Exploitability

The CVSS score is 6.9 and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, but it has been publicly disclosed and a proof‑of‑concept exploit is available. Attackers can trigger the flaw remotely via crafted HTTP requests that alter the ID argument of the delete_cart action.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to the latest version of SourceCodester Pizzafy Ecommerce System or apply the vendor‑provided patch that mitigates the delete_cart SQL injection. If a patch is unavailable, contact SourceCodester support for a fix.
  • Add server‑side validation to the ID parameter of the delete_cart endpoint, accepting only numeric values within a safe range, and enforce prepared statements or parameterized queries to eliminate unfiltered user input from SQL statements.
  • Configure or deploy a web application firewall that detects and blocks SQL injection attempts targeting the delete_cart action, and consider restricting administrative access to trusted IP ranges.

Generated by OpenCVE AI on April 28, 2026 at 19:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester pizzafy Ecommerce System
Vendors & Products Sourcecodester
Sourcecodester pizzafy Ecommerce System
Type Values Removed Values Added
Description A security flaw has been discovered in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function delete_cart of the file /admin/ajax.php?action=delete_cart. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Title SourceCodester Pizzafy Ecommerce System ajax.php delete_cart sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 29, 2026, 2:16 PM
Reserved
Apr 27, 2026, 3:43 PM

View source JSON

Updated
Apr 29, 2026, 2:16 PM

JSON

Status
Deferred
Published
Apr 28, 2026, 6:16 AM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 28, 2026, 7:45 PM

JSON