A flaw in the SourceCodester Pizzafy Ecommerce System 1.0 allows a remote attacker to manipulate the ID argument in the /view_prod.php page, resulting in SQL injection. The vulnerability is classified as a form of input validation weakness and an injection flaw, as indicated by the CWE identifiers. An attacker can craft malicious SQL statements that the application will execute, potentially leading to data exposure, tampering, or unauthorized database operations.

The affected product is SourceCodester Pizzafy Ecommerce System version 1.0. No additional sub‑components are listed; the vulnerability resides in the view_prod.php file of this version.

The CVSS score of 5.3 indicates a medium severity. The EPSS score is not available, so the likelihood of exploitation in the wild cannot be quantified from the data. The vulnerability is not listed in the CISA KEV catalog. Because the attack can be performed remotely by altering an HTTP GET or POST parameter, an attacker with network access to the web server could potentially inject SQL commands and compromise the underlying database.