The vulnerability exists in the function save_menu of /admin/ajax.php?action=save_menu in SourceCodester Pizzafy Ecommerce System 1.0. It allows an attacker to inject malicious SQL statements by manipulating input parameters, resulting in unauthorized data access, modification, or deletion. The injected code can alter the database state, potentially exposing sensitive customer information or compromising system integrity. The weakness is identified as CWE-74 (Injection) and CWE-89 (SQL Injection).

The affected product is SourceCodester Pizzafy Ecommerce System version 1.0. No other vendors or versions are listed as affected.

The CVSS score of 5.1 indicates a moderate risk profile, with no EPSS score available and the vulnerability not listed in the CISA KEV catalog. The attack vector is remote, meaning an attacker can trigger the flaw from anywhere with network access to the vulnerable system. Because the exploit is publicly available, the likelihood of exploitation is significant for systems that run this unpatched version.