Vulnerability · Published Apr 28, 2026 · Assigned by VulDB
CVE-2026-7228SourceCodester Pizzafy Ecommerce System ajax.php get_cart_count sql injection
High 7.3
In plain English
A high-severity SQL injection in Pizzafy Ecommerce System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function get_cart_count of the file /admin/ajax.php?action=get_cart_count. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SourceCodester | Pizzafy Ecommerce System | 1.0 |
Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-359828 | SourceCodester Pizzafy Ecommerce System ajax.php get_cart_count sql injection vdb-entry, technical-description
- VDB-359828 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #802416 | SourceCodester Pizzafy Ecommerce System 1.0 SQL Injection third-party-advisory
- https://github.com/fernando-mengali/vulndb-submissions/blob/main/05-vul-SQLI.md exploit
- https://www.sourcecodester.com/ product