| عنوان | SourceCodester Pizzafy Ecommerce System 1.0 SQL Injection |
|---|
| الوصف | Title: Pizzafy Ecommerce System 1.0
Vulnerability Type: SQL Injection (Based Error)
Severity: HIGH
Status: Unpatched
Description:
A Error-based SQL Injection vulnerability was discovered in the DELETE functionality of the Pizzafy Ecommerce System.
This vulnerability occurs because the id parameter and id column is not properly sanitized, allowing an attacker to inject malicious SQL commands into the backend database query.
Affected Version: 1.0
Endpoint or parameter vulnerable: admin/ajax.php?action=delete_category
PoC:
id=4'
References:
https://www.sourcecodester.com/php/18708/pizzafy-ecommerce-system.html |
|---|
| المصدر | ⚠️ https://github.com/fernando-mengali/vulndb-submissions/blob/main/11-vul-SQLI.md |
|---|
| المستخدم | Fernando Mengali (UID 83791) |
|---|
| ارسال | 10/04/2026 09:34 PM (2 أشهر منذ) |
|---|
| الاعتدال | 28/04/2026 12:26 PM (18 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 359953 [SourceCodester Pizzafy Ecommerce System 1.0 ajax.php?action=delete_category معرف حقن SQL] |
|---|
| النقاط | 20 |
|---|