This vulnerability affects SourceCodester Pizzafy Ecommerce System 1.0 in the save_menu function of the /admin/ajax.php endpoint. An attacker with high privileges can remotely exploit this flaw by manipulating input parameters to execute SQL injection attacks. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No official fix or patch has been published, and the exploit code is publicly available.

Successful exploitation could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability requires no user interaction but does require high privileges, which limits the attack surface somewhat. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and monitor for suspicious activity related to the save_menu function. Avoid exposing administrative interfaces to untrusted networks.