A critical SQL injection vulnerability in SourceCodester Pizzafy E-Commerce System 1.0 allows unauthenticated attackers to manipulate backend database queries and access sensitive data.

The vulnerability exists in the '/admin/ajax.php?action=confirm_order' endpoint, where insufficient input sanitization of the 'ID' parameter allows for SQL injection (CWE-89). This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands directly against the database.

With a CVSS score of 7.3, this vulnerability poses a severe risk of data breach and unauthorized modification of e-commerce records. Potential consequences include unauthorized access to customer information, order history, and administrative credentials, which could lead to significant reputational damage and financial loss for the business.

Immediate Action: As there is no official patch, verify if the vendor has issued updates or security guidance. If not, consider disabling the vulnerable endpoint or restricting access to the administrative directory to trusted IP addresses only.

Proactive Monitoring: Monitor database query logs for unusual activity, particularly queries originating from the '/admin/ajax.php' script that deviate from standard order confirmation patterns.

Compensating Controls: Implement WAF filtering to inspect incoming HTTP requests for malicious SQL injection payloads targeting the 'ID' parameter in order-related requests.

Public Exploit Available: True

The presence of public exploit code necessitates immediate action to restrict access to the vulnerable system. Security teams should prioritize limiting exposure of the administrative interface and implementing robust WAF protections until a formal vendor patch is applied.