A critical SQL injection vulnerability in SourceCodester Pizzafy Ecommerce System 1.0 allows unauthenticated remote attackers to compromise database integrity and confidentiality.

The application fails to sanitize the id parameter in the delete_menu function of /admin/ajax.php, which is susceptible to an error-based SQL injection. This allows an unauthenticated attacker to execute arbitrary SQL queries against the backend database.

Successful exploitation grants an attacker the ability to extract sensitive information, including user credentials and database schema, or manipulate application records. Given the CVSS score of 7.3, this flaw poses a significant risk to data privacy and system integrity. Unauthorized access to the backend database can lead to full system compromise and significant reputational damage.

Immediate Action: There is currently no official patch from the vendor for this version; users should restrict access to the /admin directory via network-level controls or web server configurations until a secure update is released.

Proactive Monitoring: Monitor server logs for HTTP POST requests to /admin/ajax.php containing SQL syntax patterns or unexpected characters in the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to mitigate the risk of exploitation.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the technical submission referenced by VulDB.

Organizations utilizing SourceCodester Pizzafy Ecommerce System 1.0 must treat this vulnerability with high priority. Because the system is currently unpatched, immediate implementation of compensating controls, such as WAF filtering, is required to prevent unauthorized data access. Security teams should prioritize moving to a more secure alternative or applying vendor-provided patches as soon as they become available.