CVE-2026-7407

SourceCodester Pizzafy Ecommerce System Setting ajax.php save_settings sql injection

View on CVE.org
Published Apr 29, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is the function save_settings of the file /pizzafy/admin/ajax.php?action=save_settings of the component Setting Handler. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Analysis

AI-generated

Technical impact

A remote attacker can exploit an SQL injection flaw in the save_settings function of SourceCodester Pizzafy Ecommerce System 1.0 by sending crafted input to the /pizzafy/admin/ajax.php?action=save_settings endpoint. The vulnerability arises from insufficient input validation, enabling the execution of arbitrary SQL commands. This can lead to unauthorized modification of configuration data, potential data exfiltration, and compromise of the system’s integrity, without requiring local access.

Affected Systems

The vulnerable component is the SourceCodester Pizzafy Ecommerce System, version 1.0. No other affected versions are currently documented. Site administrators should verify whether their deployment matches this version or earlier revisions of the application.

Risk and Exploitability

The CVSS score of 5.1 classifies the vulnerability as medium severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalogue, indicating no known widespread exploits at this time. The attack vector is remote via HTTP requests, potentially requiring the target to be publicly reachable and the attacker to craft a valid AJAX request to the administrative endpoint.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s latest patch or upgrade to a version of Pizzafy Ecommerce System that removes the SQL injection flaw in save_settings.
  • If an update is not immediately possible, implement server‑side input sanitization for the save_settings endpoint, ensuring that only expected parameters are accepted and using prepared statements for database interactions.
  • Restrict access to the admin interface by enforcing strong authentication, applying IP whitelisting, or placing it behind a VPN to limit exposure to the vulnerable endpoint.

Generated by OpenCVE AI on April 30, 2026 at 03:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester pizzafy Ecommerce System
Vendors & Products Sourcecodester
Sourcecodester pizzafy Ecommerce System
Type Values Removed Values Added
Description A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is the function save_settings of the file /pizzafy/admin/ajax.php?action=save_settings of the component Setting Handler. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Title SourceCodester Pizzafy Ecommerce System Setting ajax.php save_settings sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 30, 2026, 12:14 PM
Reserved
Apr 29, 2026, 1:17 PM

View source JSON

Updated
Apr 30, 2026, 12:14 PM

JSON

Status
Deferred
Published
Apr 29, 2026, 9:16 PM
Modified
Oct 26, 2026, 8:10 PM

View source JSON

No data.

Updated
Apr 30, 2026, 3:45 AM

JSON