CVE-2026-7224: SourceCodester Pizzafy Ecommerce System ajax.php delete_cart sql injection
A security flaw has been discovered in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function deletecart of the file /admin/ajax.php?action=deletecart. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Because the SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 occurs in ajax.php?action=delete_cart and can be initiated remotely, restrict remote access to the affected endpoint/route (e.g., admin ajax.php action=delete_cart) using network controls (IP allowlisting/ACLs) so only trusted clients can reach it.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7224?
CVE-2026-7224 is considered a high severity vulnerability due to its potential for SQL injection exploitation.
How do I fix CVE-2026-7224?
To fix CVE-2026-7224, you should validate and sanitize the input for the 'ID' parameter in the /admin/ajax.php file.
What is the impact of CVE-2026-7224?
The impact of CVE-2026-7224 can lead to unauthorized access and manipulation of the database through SQL injection attacks.
Which versions are affected by CVE-2026-7224?
CVE-2026-7224 affects only SourceCodester Pizzafy Ecommerce System version 1.0.
Is there a patch for CVE-2026-7224?
Currently, there is no official patch for CVE-2026-7224, so it's recommended to implement input validation and parameterized queries as a workaround.