This vulnerability allows an unauthenticated remote attacker to perform SQL injection attacks by manipulating the ID parameter in the delete_cart function of the /admin/ajax.php endpoint in SourceCodester Pizzafy Ecommerce System 1.0. The flaw arises from improper input validation or sanitization, enabling injection of malicious SQL commands. The CVSS 4.0 base score is 6.9, indicating a medium severity level with network attack vector, low complexity, and no privileges or user interaction required. The vulnerability is publicly disclosed with exploit code available, but no official fix or patch has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. This could compromise the integrity and confidentiality of the ecommerce system's data. Since the attack requires no authentication and can be performed remotely, the risk of exploitation is significant. However, the lack of an official patch means the vulnerability remains exploitable in affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and sanitization on the ID parameter in the delete_cart function to mitigate SQL injection risks. Additionally, restricting access to the /admin/ajax.php endpoint and monitoring for suspicious activity may help reduce exposure.