This vulnerability in SourceCodester Pizzafy Ecommerce System 1.0 allows an attacker to perform SQL injection via the ID parameter in the delete_menu function accessed through /admin/ajax.php?action=delete_menu. The injection flaw permits remote attackers to manipulate SQL queries, potentially leading to unauthorized data access or modification. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, with low to low impact on confidentiality, integrity, and availability. No official fix or patch has been published by the vendor, and the system is not cloud-hosted, so remediation depends on the user or administrator.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, modification, or deletion. Given the medium severity and partial impact on confidentiality, integrity, and availability, this could affect the integrity and confidentiality of the ecommerce system's data. However, no confirmed active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint, implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the delete_menu function, and reviewing application code for proper input validation and parameterized queries to mitigate risk.