CVE-2026-7228
Published: 28 April 2026
Summary
CVE-2026-7228 is a high-severity Injection (CWE-74) vulnerability in Sourcecodester (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by requiring validation of untrusted inputs such as the manipulable ID argument in the get_cart_count function.
Mandates timely identification, reporting, and correction of flaws like this SQL injection vulnerability to eliminate the exploit path.
Facilitates proactive discovery of the SQL injection vulnerability through regular scanning of the affected application.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a public-facing web application (ajax.php) directly enables exploitation of public-facing applications for initial access.
NVD Description
A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function get_cart_count of the file /admin/ajax.php?action=get_cart_count. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely.…
more
The exploit has been published and may be used.
Deeper analysisAI
CVE-2026-7228 is a SQL injection vulnerability (CWE-74, CWE-89) in SourceCodester Pizzafy Ecommerce System 1.0. The flaw resides in the get_cart_count function within the file /admin/ajax.php?action=get_cart_count, where manipulation of the ID argument triggers the injection.
The vulnerability is remotely exploitable by unauthenticated attackers (PR:N) with low attack complexity (AC:L) and no user interaction required (UI:N), earning a CVSS v3.1 base score of 7.3 (S:U/C:L/I:L/A:L). Exploitation enables limited impacts on confidentiality, integrity, and availability, and a public exploit is available for use.
Advisories on VulDB (including vuln/359828 and related CTI) and a GitHub submission in fernando-mengali/vulndb-submissions detail the SQL injection, its proof-of-concept, and remote attack vector, but do not specify patches or vendor-provided mitigations. The SourceCodester website is referenced as the software source.
The published exploit raises the risk of real-world abuse against unpatched instances of this ecommerce system.
Details
- CWE(s)