CVE-2026-7394

MEDIUM

SourceCodester Pizzafy Ecommerce System GET Parameter view_order.php sql injection

Title source: cna

Description

A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/view_order.php of the component GET Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Exploits (1)

nomisec WRITEUP

by Xmyronn · poc

https://github.com/Xmyronn/CVE-2026-7394-SQLI

View Code ZIP pw:eip

References (5)

[Vdb Entry, Technical Description] https://vuldb.com/vuln/360119

[Signature, Permissions Required] https://vuldb.com/vuln/360119/cti

[Third Party Advisory] https://vuldb.com/submit/803523

[Exploit] https://github.com/Xmyronn/SQL-Injection-in-Pizzafy-Ecommerce-System-admin-view_order.php.git

[Product] https://www.sourcecodester.com/

Scores

CVSS v3 4.7

EPSS 0.0003

EPSS Percentile 7.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-74 CWE-89

Status published

Products (1)

SourceCodester/Pizzafy Ecommerce System 1.0

Published Apr 29, 2026

Tracked Since Apr 29, 2026