A remote attacker can exploit an SQL injection flaw in the save_settings function of SourceCodester Pizzafy Ecommerce System 1.0 by sending crafted input to the /pizzafy/admin/ajax.php?action=save_settings endpoint. The vulnerability arises from insufficient input validation, enabling the execution of arbitrary SQL commands. This can lead to unauthorized modification of configuration data, potential data exfiltration, and compromise of the system’s integrity, without requiring local access.

The vulnerable component is the SourceCodester Pizzafy Ecommerce System, version 1.0. No other affected versions are currently documented. Site administrators should verify whether their deployment matches this version or earlier revisions of the application.

The CVSS score of 5.1 classifies the vulnerability as medium severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalogue, indicating no known widespread exploits at this time. The attack vector is remote via HTTP requests, potentially requiring the target to be publicly reachable and the attacker to craft a valid AJAX request to the administrative endpoint.