PT-2026-36013 · Sourcecodester · Pizzafy Ecommerce System

R3Ng4F · Published 2026-04-29 · Updated 2026-04-30 · CVE-2026-7407

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SourceCodester Pizzafy Ecommerce System version 1.0

Description An issue in the Setting Handler component allows for remote SQL injection. This occurs within the save settings() function located in the '/pizzafy/admin/ajax.php?action=save settings' endpoint.

Recommendations As a temporary workaround, restrict access to the '/pizzafy/admin/ajax.php?action=save settings' endpoint or disable the save settings() function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-7407

Affected Products

Pizzafy Ecommerce System

References · 7

• 🔥 https://github.com/r3ng4f/Pizzafy_1/blob/main/01-exploit.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7407 · Security Note
• https://sourcecodester.com · Note
• https://twitter.com/VulmonFeeds/status/2049662459900830183 · Twitter Post
• https://vuldb.com/vuln/360141 · Note
• https://vuldb.com/vuln/360141/cti · Note
• https://vuldb.com/submit/803613 · Note