| शीर्षक | sourcecodester Pizzafy Ordering System V1.0 SQL Injection |
|---|
| विवरण | During the security review of "Pizzafy Ordering System", a critical SQL injection vulnerability was identified in the /admin/view_order.php file. The vulnerability exists due to the application directly using user-controlled input from the id GET parameter in SQL queries without any sanitization, validation, or parameterized processing.
This flaw is exploitable via multiple SQL injection vectors including boolean-based blind, error-based, time-based blind, and UNION query injection. Unauthenticated remote attackers can inject malicious SQL payloads to manipulate database queries, access and extract all data from the backend database, and perform unauthorized database operations. |
|---|
| स्रोत | ⚠️ https://github.com/nidieaaa/test/issues/7 |
|---|
| उपयोगकर्ता | baiqiuran (UID 97198) |
|---|
| सबमिशन | 14/04/2026 01:09 PM (6 महीनों पहले) |
|---|
| संयम | 30/04/2026 08:54 PM (16 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 360119 [SourceCodester Pizzafy Ecommerce System 1.0 GET Parameter /admin/view_order.php पहचान SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|