This vulnerability affects SourceCodester Pizzafy Ecommerce System 1.0 and arises from improper sanitization of the e-mail parameter in the login2 function of /admin/ajax.php. An attacker can remotely inject SQL code through this parameter, potentially compromising the backend database. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity with network attack vector, no privileges required, and no user interaction needed. The vendor has not released a patch or official remediation guidance as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication or user interaction. However, the impact is rated medium severity, and no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, it is recommended to implement input validation and sanitization on the e-mail parameter in the login2 function to mitigate SQL injection risks. Monitoring for unusual database activity may also be prudent. Avoid exposing the vulnerable endpoint publicly if possible.