CVE-2026-7410 — SourceCodester Pizzafy Ecommerce System SQL Injection

title: CVE-2026-7410 - Pizzafy Ecommerce SQL Injection in add_to_cart
id: scw-2026-04-29-ai-1
status: experimental
level: critical
description: |
  Detects attempts to exploit CVE-2026-7410 by targeting the '/admin/ajax.php?action=add_to_cart' endpoint with SQL injection payloads. The rule specifically looks for the 'pid' parameter being manipulated with common SQL keywords like 'UNION', 'SELECT', and 'FROM', indicating an attempt to extract data from the database.
author: SCW Feed Engine (AI-generated)
date: 2026-04-29
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7410/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      uri|contains:
          - '/admin/ajax.php?action=add_to_cart'
      cs-uri-query|contains:
          - 'pid='
      cs-uri-query|contains:
          - 'UNION'
      cs-uri-query|contains:
          - 'SELECT'
      cs-uri-query|contains:
          - 'FROM'
      condition: uri AND cs-uri-query
  selection_base:
      uri|contains:
          - '/admin/ajax.php?action=add_to_cart'
  selection_indicators:
      cs-uri-query|contains:
          - 'pid='
      cs-uri-query|contains:
          - 'UNION'
      cs-uri-query|contains:
          - 'SELECT'
      cs-uri-query|contains:
          - 'FROM'
      condition: selection_base AND selection_indicators
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse