This vulnerability originates from unsanitized handling of the ID parameter in /admin/ajax.php?action=confirm_order of the SourceCodester Pizzafy E‑Commerce System 1.0. The lack of input filtering allows an attacker to inject arbitrary SQL fragments, enabling the execution of unintended queries against the underlying database. The impact of the injected queries is not explicitly described in the CV the flaw represents a classic SQL injection weakness consistent with CWE‑74 and CWE‑89.

SourceCodester Pizzafy E‑Commerce System version 1.0 is affected. The flaw is present in the /admin/ajax.php script and applies to all installations via the ID argument of the confirm_order action and can be triggered from any machine that can reach the web server hosting the application.

The CVSS score of 6.9 indicates a medium severity, while the EPSS score of < 1% suggests exploitation is currently unlikely but still possible. The flaw is exploitable remotely from outside the network, and the public release of an exploit indicates that attacks could be automated. Although it is not listed in CISA’s KEV catalog, the availability of a public exploit encourages monitoring.