pizzafy-1.0 contains multiple critical vulnerabilities: (1) SQL injection in the email parameter of the login functionality that allows remote code execution via MySQL's load_file function with UNC paths, and (2) arbitrary file upload vulnerability in the img parameter of the menu page that allows unauthenticated attackers to upload and execute arbitrary PHP code on the server.
| Vendor | Product | Versions |
|---|---|---|
| pizzafy | pizzafy | 1.0 |
Loading…
