The vulnerability resides in the login2 function of /admin/ajax.php, where the e‑mail argument is not properly sanitized, allowing an attacker to inject SQL statements. By exploiting this flaw, an attacker can retrieve, modify, or delete data in the backend database, leading to credential compromise, data theft, or integrity violations. The impact concerns the confidentiality, integrity, and availability of the store’s information. Based on the description, the flaw is a classic SQL injection (CWE‑89) and a form‑based injection (CWE‑74).

SourceCodester Pizzafy Ecommerce System 1.0. No other versions or products are listed as affected.

The CVSS score of 6.9 indicates a medium severity vulnerability with remote exploitation possible. EPSS information is not available, but the exploit has been publicly disclosed and “may be used,” implying that attackers could readily construct a payload. Since the attack can be performed over the network via the publicly reachable login2 endpoint, the likelihood of exploitation is significant for exposed installations. The vulnerability is not currently listed in the CISA KEV catalog, but the public disclosure pattern suggests that it can be actively leveraged.