This vulnerability exists in SourceCodester Pizzafy Ecommerce System 1.0 within the save_category function accessed through /admin/ajax.php?action=save_category. Manipulating the Name argument leads to SQL injection, enabling an attacker to interfere with the application's database queries. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official patch or vendor remediation level has been provided, and the product is not a cloud service. Exploits have been publicly disclosed but are not known to be actively exploited in the wild.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability requires no user interaction and can be exploited remotely with low complexity, but some privileges may be needed. The impact is rated medium severity with limited scope and impact metrics.

No official patch or remediation guidance is currently available from the vendor. Since the vulnerability is publicly disclosed, users should monitor vendor channels for updates. Until a fix is released, consider restricting access to the affected endpoint and validating or sanitizing inputs at the application or web server level to mitigate injection risks.