This vulnerability affects SourceCodester Pizzafy Ecommerce System 1.0 specifically in the login functionality handled by /admin/ajax.php?action=login. An attacker can manipulate the e-mail argument to inject SQL commands, potentially compromising the backend database. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9, indicating medium severity. There is no vendor-provided patch or official remediation guidance available as of the published date. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other database impacts depending on the database permissions. The vulnerability is exploitable remotely without authentication, increasing the attack surface. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, consistent with a medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the login e-mail parameter. Additionally, reviewing and hardening input validation and parameterized queries in the affected login function is recommended if source code access is available.