The flaw allows an attacker to insert malicious SQL through the e‑mail field in the login routine at /admin/ajax.php?action=login. The injection can be performed remotely and would let the attacker retrieve or modify database contents, potentially gaining full control of the system. The weakness is an unchecked SQL query, a classic SQL injection (CWE‑89) triggered by incorrect input encoding (CWE‑74).

The vulnerable product is SourceCodester Pizzafy Ecommerce System version 1.0. The flaw exists in the web application’s admin login API. No other products or versions are listed. The system is a PHP‑based e‑commerce platform that may be hosted on a typical web server with a MySQL database.

The CVSS score of 6.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not yet listed in CISA KEV. Because the attack can be triggered from any remote web client and requires no privileged context, the likelihood of exploitation is significant if the public exploit code is in circulation. Attackers can craft a specially crafted e‑mail value to extract arbitrary data or alter credentials.