SourceCodester Pizzafy Ecommerce System 1.0 contains a SQL injection vulnerability in the /admin/ajax.php?action=add_to_cart endpoint. The vulnerability arises from improper sanitization of the pid parameter, allowing an attacker to inject arbitrary SQL commands. The vulnerability is remotely exploitable without requiring user interaction or elevated privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. No official fix or patch has been published as of the data provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access or modification. The impact is limited by the vulnerability's low complexity and lack of required privileges, but the overall severity is medium. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint and applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the pid parameter.