SourceCodester Pizzafy Ecommerce System 1.0 contains a SQL injection vulnerability in the get_cart_count function located in /admin/ajax.php?action=get_cart_count. The vulnerability arises from improper sanitization of the ID parameter, enabling remote attackers to inject malicious SQL commands. This can lead to unauthorized data access or modification. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No official patch or vendor advisory is currently available.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database. This may result in unauthorized disclosure, modification, or deletion of data within the ecommerce system. The impact is limited to the confidentiality, integrity, and availability of the affected system components as indicated by the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and sanitization on the ID parameter in the get_cart_count function. Restricting access to the /admin/ajax.php endpoint and monitoring for suspicious activity may also help reduce risk.