This vulnerability exists in SourceCodester Pizzafy Ecommerce System 1.0 within the login function located at /admin/ajax.php?action=login. The 'e-mail' parameter is vulnerable to SQL injection, enabling an unauthenticated remote attacker to inject malicious SQL commands. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability is publicly disclosed, but no official fix or patch is currently available.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database through the login interface, potentially leading to unauthorized data access or manipulation. However, the impact is rated medium severity, reflecting limited scope or complexity of exploitation as per the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'e-mail' parameter in the login function.