| タイトル | SourceCodester Pizzafy Ecommerce System 1.0 SQL Injection |
|---|
| 説明 | Title: Pizzafy Ecommerce System 1.0
Vulnerability Type: SQL Injection (Based Error)
Severity: HIGH
Status: Unpatched
Description:
A Error-based SQL Injection vulnerability was discovered in the SELECT functionality of the Pizzafy Ecommerce System. This vulnerability occurs because the id parameter is not properly sanitized, allowing an attacker to inject malicious SQL commands into the backend database query.
Affected Version: 1.0
Endpoint or parameter vulnerable:
pizza/index.php?page=category&id=1
PoC:
http://localhost/pizza/index.php?page=category&id=1%20AND%20extractvalue(1,%20concat(0x7e,%20(SELECT%20table_name%20FROM%20information_schema.tables%20WHERE%20table_schema=database()%20LIMIT%200,1)))%20--
References:
https://www.sourcecodester.com/php/18708/pizzafy-ecommerce-system.html |
|---|
| ソース | ⚠️ https://github.com/fernando-mengali/vulndb-submissions/blob/main/07-vul-SQLI.md |
|---|
| ユーザー | Fernando Mengali (UID 83791) |
|---|
| 送信 | 2026年04月10日 21:08 (2 月 ago) |
|---|
| モデレーション | 2026年04月28日 07:23 (17 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 359916 [SourceCodester Pizzafy Ecommerce System 1.0 index.php?page=category 識別子 SQLインジェクション] |
|---|
| ポイント | 20 |
|---|