SourceCodester Pizzafy Ecommerce System 1.0 contains a SQL injection vulnerability in the save_user function of the /admin/ajax.php endpoint. This flaw allows an attacker with high privileges to remotely inject SQL commands by manipulating input parameters. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity, with network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability. No official patch or fix is currently available, and the vendor has not issued remediation guidance.

Successful exploitation of this vulnerability could allow an attacker with high privileges to perform unauthorized SQL queries, potentially leading to unauthorized data access or modification within the affected ecommerce system. The impact is limited by the requirement for high privileges and the low scope of confidentiality, integrity, and availability impacts as per the CVSS vector. There are no confirmed active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected functionality to trusted administrators only and monitor for suspicious activity related to the save_user function. Avoid exposing the vulnerable endpoint to untrusted networks where possible.