CVE-2026-10558: SourceCodester Pizzafy Ecommerce System index.php file inclusion
A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument page results in file inclusion. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Pizzafy Ecommerce System (/admin/index.php)from your environment.If the admin interface is not required, remove or disable /admin/index.php (or take the admin area offline) until a secure fix is implemented.
- Configuration
Modify /admin/index.php so the 'page' parameter is not directly used in file includes. Implement strict server-side validation: map allowed page values to fixed filenames (whitelist) or use a switch/case, normalize and canonicalize input, and reject any unexpected values to prevent local/remote file inclusion.
SourceCodester Pizzafy Ecommerce System (/admin/index.php) page parameter handling = whitelist - Compensating control
Restrict access to the /admin interface to trusted IPs or internal networks (via firewall, web server access rules, VPN, or WAF). If possible, place the admin endpoint behind an authenticated management network or application firewall to block exploitation attempts.
- Operational
Treat the vulnerability as exploitable (exploit is public): review web and system logs for signs of exploitation, verify integrity of web application files, restore affected files from known-good backups if necessary, and rotate administrative credentials and any exposed secrets.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10558?
The severity of CVE-2026-10558 is classified as low with a score of 2.1.
How do I fix CVE-2026-10558?
To fix CVE-2026-10558, ensure that input validation is applied to the 'page' parameter in /admin/index.php to prevent file inclusion.
What type of vulnerability is CVE-2026-10558?
CVE-2026-10558 is a remote file inclusion vulnerability affecting SourceCodester Pizzafy Ecommerce System.
What are the potential impacts of CVE-2026-10558?
Exploitation of CVE-2026-10558 could lead to unauthorized access to files on the server and potential data loss.
Who is affected by CVE-2026-10558?
Users of SourceCodester Pizzafy Ecommerce System version 1.0 are affected by CVE-2026-10558.