A critical SQL injection vulnerability in the SourceCodester Pizzafy Ecommerce System 1.0 allows unauthenticated remote attackers to compromise database integrity and confidentiality.

This is an error-based SQL injection flaw (CWE-89) located in the /admin/ajax.php endpoint within the login2 function. The application fails to properly sanitize the email parameter, enabling an unauthenticated attacker to inject malicious SQL commands and manipulate backend database queries.

Successful exploitation of this vulnerability can lead to full database compromise, including the unauthorized retrieval of user credentials, sensitive personal information, and administrative session data. Given the CVSS score of 7.3, the potential for data exfiltration and complete system takeover presents a high risk to business operations, data privacy compliance, and overall system security posture.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the /admin/ajax.php endpoint via network-level controls until a secure update is released.

Proactive Monitoring: Security teams should implement logging and monitoring for the /admin/ajax.php URI, specifically looking for anomalous POST requests containing SQL syntax characters such as single quotes, UNION operators, or comment delimiters.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming traffic containing common SQL injection patterns targeting the email parameter in the login2 function.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked research write-up on GitHub.

The severity of this vulnerability, combined with the availability of public proof-of-concept material, necessitates immediate defensive action. Organizations utilizing the Pizzafy Ecommerce System should prioritize isolating the affected component and implementing the suggested WAF rules to prevent unauthorized database access. Continued monitoring for official vendor security updates is essential to ensuring long-term remediation.