CVE-2026-7408

SourceCodester Pizzafy Ecommerce System ajax.php save_menu sql injection

CVSS 5.1 MEDIUMEPSS 0.3%CWE-74 CWE-89

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function save_menu of the file /admin/ajax.php?action=save_menu. Performing a manipulation results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

SourceCodester · Pizzafy Ecommerce System

public PoCs found — 1

cve_referencegithub.com/r3ng4f/Pizzafy_1/blob/main/02-exploit.mdunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/r3ng4f/Pizzafy_1/blob/main/02-exploit.md https://vuldb.com/submit/803623 https://vuldb.com/vuln/360142 https://vuldb.com/vuln/360142/cti https://www.sourcecodester.com/