A flaw exists in the get_cart_items function of SourceCodester Pizzafy Ecommerce System 1.0 that allows an attacker to inject arbitrary SQL statements by manipulating the ID parameter of the admin/ajax.php?action=get_cart_items endpoint. The weakness is identified as CWE-74 and CWE-89. An attacker can deliver a specially crafted HTTP request to execute SQL injection against the backend database, potentially exposing sensitive data or altering application state. The public exploit code indicates that the attack vector is remote and does not require authentication.

SourceCodester Pizzafy Ecommerce System, version 1.0, specifically the /admin/ajax.php script handling the get_cart_items action.

The CVSS base score is 5.3, indicating medium severity. The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV. Exploitation requires only an unauthenticated HTTP request to a publicly accessible endpoint, and publicly available exploit code demonstrates the feasibility of this attack for an attacker with remote network access.