The vulnerability exists in the delete_category function of the /admin/ajax.php?action=delete_category endpoint in SourceCodester Pizzafy Ecommerce System 1.0. By manipulating the ID parameter, an attacker can perform SQL injection, potentially allowing unauthorized database queries or modifications. The attack can be launched remotely without user interaction and requires high privileges. The vulnerability is publicly known, but no official fix or patch has been disclosed by the vendor. The CVSS 4.0 vector indicates network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is limited as the vulnerability requires high privileges and has low to limited impact on confidentiality, integrity, and availability according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint and ensure that only trusted administrators have the necessary privileges. Implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the delete_category function. Monitor for any updates from the vendor regarding patches or mitigations.