The SourceCodester Pizzafy Ecommerce System contains a code flaw in the file /admin/ajax.php at the action add_to_cart. Manipulating the pid parameter leads to an SQL injection, which allows an attacker to execute arbitrary SQL commands against the system database. This can result in unauthorized reading, modification, or deletion of data, potentially compromising the confidentiality, integrity, and availability of the application’s data store.

The affected product is SourceCodester Pizzafy Ecommerce System version 1.0. No additional version information is listed in the CNA data, so all deployments of this version should be assumed vulnerable.

The CVSS score is 5.3, indicating a moderate risk. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector appears to be remote, as the vulnerable endpoint can be accessed via HTTP requests, and no authentication requirement is explicitly mentioned. Therefore, it is inferred that an external attacker could potentially exploit the flaw without prior credentials. Once injected, the attacker could perform database manipulation operations that undermine the application’s security.