This vulnerability exists in SourceCodester Pizzafy Ecommerce System 1.0 within the delete_cart function accessed via /admin/ajax.php?action=delete_cart. Manipulating the ID parameter leads to SQL injection, enabling an attacker to execute unauthorized SQL commands remotely. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. No official fix or patch has been published, and the product is not a cloud service.

Successful exploitation can allow remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity based on CVSS 4.0 scoring. There is no indication of confirmed exploitation in the wild yet, but a public exploit exists.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint, applying web application firewall (WAF) rules to detect and block SQL injection attempts, and monitoring for suspicious activity related to the delete_cart function. Avoid exposing the admin ajax.php endpoint to untrusted networks if possible.