SourceCodester Pizzafy Ecommerce System 1.0 contains a SQL injection vulnerability in the get_cart_count function located in /admin/ajax.php?action=get_cart_count. The vulnerability arises from improper sanitization of the ID parameter, allowing remote attackers to inject malicious SQL commands. This can lead to unauthorized data access or manipulation. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No official patch or remediation level is currently documented.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may result in unauthorized disclosure, modification, or deletion of data within the ecommerce system. The impact is limited to the confidentiality, integrity, and availability of the affected system's data as indicated by the CVSS vector. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the vulnerable endpoint (/admin/ajax.php?action=get_cart_count) to trusted users only and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter. Monitor vendor channels for updates regarding patches or official mitigations.