CVE-2026-14713: SQL Injection in SourceCodester Pizzafy E-Commerce System 1.0

Technical summary

CVE-2026-14713 is a unauthenticated SQL injection flaw affecting SourceCodester Pizzafy E-Commerce System 1.0. The vulnerability exists in the admin AJAX handler at /admin/ajax.php when processing the confirm_order action. Insufficient input validation on the ID parameter permits attackers to inject malicious SQL syntax. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-89 (SQL Injection), indicating both a root cause and a consequence classification. The CVSS v3.1 score of 7.3 reflects high severity due to low attack complexity, no privilege requirements, no user interaction, and achievable confidentiality, integrity, and availability impact.

Business impact

Compromise of an affected Pizzafy installation enables attackers to query, modify, or delete customer and order data without authorization. This includes extraction of payment card information, customer personally identifiable information (PII), and transaction histories. Attackers could also manipulate order records, affecting business operations and customer trust. The public availability of exploit code substantially increases the window of exposure and risk of opportunistic compromise across the broader user base.

Affected systems

SourceCodester Pizzafy E-Commerce System version 1.0 is confirmed as vulnerable. No patch version or vendor mitigation guidance is documented in the available source data. Any deployment of version 1.0 should be considered at risk. Verify current system versions in your environment and consult the SourceCodester advisory for information on patched versions or workarounds.

Exploitability

This vulnerability has a high exploitability profile. The attack vector is network-based, requiring no authentication, no special privileges, and no user interaction. Attack complexity is low. Public exploit code is available, removing the barrier to exploitation for unskilled attackers. Any internet-facing Pizzafy installation running version 1.0 is immediately at risk of compromise.

Remediation

Immediate action is required. Check your environment for SourceCodester Pizzafy E-Commerce System installations. For systems running version 1.0, verify availability of a patched release from SourceCodester. If a patch exists, apply it to all affected instances immediately. If no patch is available, consider taking the application offline or restricting access to the /admin/ajax.php endpoint at the network level pending a vendor fix. Implement input validation and parameterized queries if applying patches is delayed.

Patch guidance

Consult the SourceCodester vendor advisory to identify the patched version for Pizzafy E-Commerce System. Apply patches to all production and development instances without delay. Test patches in a staging environment to ensure compatibility with your deployment before rolling out to production. If the vendor has not yet released a patch, request an estimated timeline from SourceCodester and consider interim network-level mitigations.

Detection guidance

Monitor web server and application logs for suspicious requests to /admin/ajax.php with the confirm_order action and ID parameters containing SQL metacharacters (e.g., single quotes, UNION, SELECT, OR 1=1). Watch for unusual database query patterns or database activity initiated from the web application process. Network-based intrusion detection signatures should flag attempts to exploit SQL injection in this endpoint. Correlate web access logs with database query logs to identify anomalous access patterns to sensitive tables.

Why prioritize this

This vulnerability merits immediate prioritization due to its high CVSS score (7.3), unauthenticated remote exploitability, publicly available exploit code, and direct access to sensitive customer and transactional data. The low barrier to exploitation and the critical nature of the affected data (payment info, PII) make rapid remediation essential. Any internet-facing Pizzafy instance should be treated as a critical security incident until patched or mitigated.

Risk score, explained

The CVSS v3.1 score of 7.3 (HIGH) reflects the combination of unauthenticated remote network access (AV:N), low attack complexity (AC:L), no user interaction required (UI:N), and impact on confidentiality, integrity, and availability of data. The absence of scope change (S:U) and the partial impact ratings reflect the attacker's ability to read and modify database contents without full system compromise, but the practical damage to customer data and business operations justifies the HIGH severity rating.

Frequently asked questions