PT-2026-35963 · Sourcecodester · Pizzafy Ecommerce System

Imad Alvi · Published 2026-04-29 · Updated 2026-04-29 · CVE-2026-7394

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SourceCodester Pizzafy Ecommerce System version 1.0

Description A remote SQL injection exists in the GET Parameter Handler of the '/admin/view order.php' file. This issue occurs when the ID argument is manipulated, allowing an attacker to execute arbitrary SQL commands.

Recommendations As a temporary workaround, avoid using the ID parameter in the '/admin/view order.php' endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-7394

Affected Products

Pizzafy Ecommerce System

References · 7

• 🔥❌ https://github.com/Xmyronn/SQL-Injection-in-Pizzafy-Ecommerce-System-admin-view_order.php.git · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2026-7394 · Security Note
• https://twitter.com/CVEnew/status/2049578385610063932 · Twitter Post
• https://vuldb.com/submit/803523 · Note
• https://sourcecodester.com · Note
• https://vuldb.com/vuln/360119/cti · Note
• https://vuldb.com/vuln/360119 · Note