CVE-2026-7394

SourceCodester Pizzafy Ecommerce System GET Parameter view_order.php sql injection

View on CVE.org
Published Apr 29, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/view_order.php of the component GET Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Analysis

AI-generated

Technical impact

A SQL injection flaw in the admin view_order.php page of SourceCodester Pizzafy Ecommerce System lets an attacker supply a malicious ID parameter and alter the database query. The flaw is a classic input validation weakness mapped to CWE-89, and it can lead to unauthorized reading, modification or deletion of order information. The CVSS score of 5.1 reflects the possibility of data compromise and moderate impact.

Affected Systems

The vulnerability affects SourceCodester Pizzafy Ecommerce System version 1.0, specifically the /admin/view_order.php component that processes the GET parameter ID.

Risk and Exploitability

The flaw is exploitable remotely and public exploits are available, yet no EPSS metric is published. Because it is not listed in CISA KEV, the exposure may be limited to sites that still run the unpatched version. An attacker who can send the crafted request can read or tamper with order data, potentially enabling later attacks if additional credentials can be obtained.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade SourceCodester Pizzafy Ecommerce System to the latest released version or apply the vendor's official patch addressing the SQL injection in view_order.php.
  • Implement input validation and parameterized queries for the ID parameter in view_order.php to prevent malformed SQL from being executed.
  • Ensure that the database user account used by the application has only the minimum privileges required—read/write on order tables, but no broader privileges—to limit damage in the event of a successful injection.
  • Consider setting web application firewalls or intrusion detection systems that flag anomalous SQL patterns on the /admin/view_order.php endpoint.

Generated by OpenCVE AI on April 29, 2026 at 21:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester pizzafy Ecommerce System
Vendors & Products Sourcecodester
Sourcecodester pizzafy Ecommerce System
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/view_order.php of the component GET Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Title SourceCodester Pizzafy Ecommerce System GET Parameter view_order.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 29, 2026, 6:31 PM
Reserved
Apr 29, 2026, 9:40 AM

View source JSON

Updated
Apr 29, 2026, 6:12 PM

JSON

Status
Deferred
Published
Apr 29, 2026, 6:16 PM
Modified
Oct 26, 2026, 8:10 PM

View source JSON

No data.

Updated
Apr 29, 2026, 9:15 PM

JSON