A flaw in the delete_menu function of the admin interface of SourceCodester Pizzafy Ecommerce System 1.0 allows a malicious actor to manipulate the ID query parameter sent to /admin/ajax.php?action=delete_menu. By inserting arbitrary SQL code into this parameter, the application can be coerced into executing unintended database statements. The vulnerability is a classic SQL injection flaw (CWE‑74 and CWE‑89) that could enable unauthorized data modification, exposure, or deletion, thereby compromising the confidentiality and integrity of the system’s data.

The affected product is SourceCodester Pizzafy Ecommerce System version 1.0. Only this version is documented as vulnerable; older or newer releases are not listed as affected. The specific exploit target is the delete_menu action within the admin/ajax.php script, which is publicly reachable via the web interface.

The CVSS score of 6.9 signals a moderate severity risk, while the EPSS score of less than 1 % indicates a very low exploit probability. The flaw is not listed in the CISA KEV catalog, so no known active exploitation has been reported. Based on the description, the attack can be launched remotely over HTTP, and no authentication or privileged access is mentioned; therefore it is inferred that unauthenticated users with network access to the application could potentially execute the injection. No additional prerequisites are identified, making the vulnerability broadly exploitable for any user who can reach the delete_menu endpoint.