This vulnerability affects SourceCodester Pizzafy Ecommerce System 1.0, specifically the get_cart_items function in /admin/ajax.php?action=get_cart_items. By manipulating the ID parameter, an attacker can perform SQL injection, potentially allowing unauthorized database queries. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 score of 5.3, indicating medium severity. No official fix or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable and does not require user interaction, increasing the risk of attack. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, and no active exploitation has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected endpoint, implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter, and reviewing input validation controls. Monitor for updates from SourceCodester regarding patches or official mitigations.