CVE-2026-7264

SourceCodester Pizzafy Ecommerce System ajax.php get_cart_items sql injection

View on CVE.org
Published Apr 28, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function get_cart_items of the file /admin/ajax.php?action=get_cart_items. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

Analysis

AI-generated

Technical impact

A flaw exists in the get_cart_items function of SourceCodester Pizzafy Ecommerce System 1.0 that allows an attacker to inject arbitrary SQL statements by manipulating the ID parameter of the admin/ajax.php?action=get_cart_items endpoint. The weakness is identified as CWE-74 and CWE-89. An attacker can deliver a specially crafted HTTP request to execute SQL injection against the backend database, potentially exposing sensitive data or altering application state. The public exploit code indicates that the attack vector is remote and does not require authentication.

Affected Systems

SourceCodester Pizzafy Ecommerce System, version 1.0, specifically the /admin/ajax.php script handling the get_cart_items action.

Risk and Exploitability

The CVSS base score is 5.3, indicating medium severity. The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV. Exploitation requires only an unauthenticated HTTP request to a publicly accessible endpoint, and publicly available exploit code demonstrates the feasibility of this attack for an attacker with remote network access.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any official update or patch for the Pizzafy Ecommerce System.
  • Modify the application to sanitize the ID parameter by using parameterized queries or proper escaping before it is incorporated into SQL statements.
  • Restrict the database account used by the application to the least privileges necessary for its normal operation.

Generated by OpenCVE AI on April 28, 2026 at 23:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester pizzafy Ecommerce System
Vendors & Products Sourcecodester
Sourcecodester pizzafy Ecommerce System
Type Values Removed Values Added
Description A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function get_cart_items of the file /admin/ajax.php?action=get_cart_items. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Title SourceCodester Pizzafy Ecommerce System ajax.php get_cart_items sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 5, 2026, 8:21 PM
Reserved
Apr 28, 2026, 5:23 AM

View source JSON

Updated
Apr 29, 2026, 3:22 PM

JSON

Status
Deferred
Published
Apr 28, 2026, 10:16 AM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Apr 28, 2026, 11:30 PM

JSON