SourceCodester Pizzafy Ecommerce System 1.0 contains an SQL injection vulnerability in the login2 function of /admin/ajax.php, specifically through the e-mail argument. This allows remote attackers to inject malicious SQL code due to insufficient input sanitization or parameterization. The vulnerability is remotely exploitable without authentication or user interaction, with low attack complexity. The CVSS 4.0 base score is 6.9 (medium severity), reflecting limited confidentiality, integrity, and availability impacts. No official patch or vendor remediation level has been published as of now.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion, potentially compromising the integrity and confidentiality of the system's data. However, the impact is rated medium, indicating limited scope or conditions for exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the e-mail parameter in the login2 function to mitigate injection risks. Monitoring for unusual database queries and restricting database permissions may also help reduce potential impact.