### Vulnerability Overview - **Vulnerability ID**: #802416 - **Vulnerability Type**: SQL Injection (Based Error) - **Severity**: HIGH - **Status**: Unpatched - **Description**: A blind-based SQL injection vulnerability was discovered in the SELECT functionality of Pizzafy Ecommerce System 1.0. The vulnerability occurs when the `id` parameter and the `user_id` column in the database are not properly sanitized, allowing attackers to inject malicious SQL commands into backend database queries. ### Impact Scope - **Affected Version**: 1.0 - **Affected Endpoint**: `/pizza/admin/ajax.php?action=get_cart_count&id=1` - **Vulnerable Parameter**: `id` ### Remediation - **Current Status**: Unpatched - **Recommendation**: Implement strict validation and sanitization of input parameters to prevent SQL injection attacks. ### POC Code ```plaintext PoC: /pizza/admin/ajax.php?action=get_cart_count&id=1%20and%20extractvalue(1,%20concat(0x7e,%20version(),%20)) ``` ### References - [SourceCodester Pizzafy Ecommerce System](https://www.sourcecodester.com/php/18706/pizzafy-ecommerce-system.html) - [GitHub Submission](https://github.com/ferrando-mengali/vulndb-submissions/blob/main/05-val-SQL.md) ### Additional Information - **Submitter**: Fernando Mengali (UID 83791) - **Submission Time**: 04-10-2026 00:46 PM (17 days ago) - **Review Time**: 04-27-2026 05:43 PM (17 days later) - **Status**: Accepted - **ValDB Entry**: 359828 - **Points**: 20