SourceCodester Pizzafy Ecommerce System 1.0 contains an SQL injection vulnerability in the save_menu function of the /admin/ajax.php?action=save_menu endpoint. This allows remote attackers to inject malicious SQL commands by manipulating input parameters, potentially compromising the backend database. The vulnerability has a CVSS 4.0 score of 5.1, indicating a medium level of severity with network attack vector and no user interaction required. No official fix or patch has been disclosed, and the vendor has not provided remediation details.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification. However, the CVSS vector indicates limited impact on confidentiality, integrity, and availability (low to limited impact). No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint to trusted users only and monitor for suspicious activity related to the save_menu function. Avoid exposing the admin interface publicly if possible.