This vulnerability affects SourceCodester Pizzafy Ecommerce System 1.0, specifically in the /admin/ajax.php?action=add_to_cart endpoint. An attacker can exploit improper input validation on the 'pid' parameter to perform SQL injection attacks, potentially manipulating the backend database. The vulnerability is remotely exploitable without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. No vendor-provided patch or mitigation details are currently available.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the requirement of low privileges and the vulnerability's partial vector characteristics (low confidentiality, integrity, and availability impact). No confirmed active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and sanitization on the 'pid' parameter in the affected endpoint to mitigate SQL injection risks. Monitor for vendor updates regarding patches or official mitigations.