The affected component is the save_order action in and admin/ajax.php of SourceCodester Pizzafy Ecommerce System 1.0. By manipulating the ID argument, an attacker can inject arbitrary SQL statements. This flaw allows the execution of unauthenticated, remote SQL queries that may read, modify, or delete data in the database, potentially exposing sensitive customer information or disrupting order processing. The weakness exhibits characteristics of CWE‑74 (Improper Neutralization of Input During Web Page Generation) and CWE‑89 (SQL Injection).

SourceCodester Pizzafy Ecommerce System version 1.0 is vulnerable. No other versions are noted as affected.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the vulnerability is publicly documented and can be triggered remotely via the /admin/ajax.php endpoint. It is not listed in CISA’s KEV catalog, yet the availability of public exploit scripts means an attacker can target this system with relative ease. The attack would require network access to the server hosting the application and the ability to send crafted HTTP requests to the vulnerable endpoint.