CVE-2026-7267

Vulnerability

Details CVE-2026-7267 describes a SQL injection vulnerability in SourceCodester Pizzafy Ecommerce System version 1.0. The flaw resides in the /view_prod.php script, where the id parameter is directly concatenated into a SQL query without sanitization [1]. This error-based SQL injection enables attackers to manipulate the SELECT operation by injecting malicious SQL commands through the id parameter.

Exploitation

The attack is remotely exploitable without authentication. An attacker simply sends a crafted HTTP GET request to /pizzafy/view_prod.php?id=<payload>. The provided proof of concept (PoC) demonstrates using extractvalue to trigger database errors that disclose sensitive information [1]. Because the application echoes MySQL errors, attackers can extract database schema, table names, and column structures through error messages.

Impact

Successful exploitation leads to full disclosure of the database, including user credentials and password hashes. Attackers can also delete or modify records, potentially causing denial of service or achieving privilege escalation via session hijacking [1]. The vulnerability is rated Medium (CVSS 6.3) but can have severe consequences if sensitive data is exposed.

Mitigation

As of the publication date, no patch is available from the vendor. The affected system is unpatched [1]. Users are advised to apply input validation and parameterized queries to mitigate the risk, or consider migrating to a supported alternative.