An unauthenticated SQL injection vulnerability in SourceCodester Pizzafy Ecommerce System 1.0 allows remote attackers to compromise sensitive database contents and bypass authentication mechanisms.

The application suffers from a critical SQL injection vulnerability within the /admin/ajax.php endpoint. By injecting malicious SQL syntax into the username parameter, an unauthenticated attacker can force the database to disclose sensitive information, including administrative credentials and system configuration data.

The exploitation of this vulnerability poses a severe risk to organizational data integrity and confidentiality. Given the CVSS score of 7.3, this flaw enables unauthorized access to backend records, which could lead to full administrative account takeover, total database exposure, and potential reputational damage resulting from a data breach.

Immediate Action: As there is no official vendor patch available, administrators should immediately restrict access to the /admin/ajax.php endpoint via network controls or web server configuration to prevent public reachability.

Proactive Monitoring: Security teams should review web access logs for suspicious POST requests targeting the login function that contain SQL-specific characters, such as single quotes, union, or database-specific function calls.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch until the underlying source code is remediated.

Public Exploit Available: Yes, a functional proof-of-concept payload and technical analysis are available via the referenced GitHub repository submitted to VulDB.

Due to the availability of public exploit material and the lack of an official patch, this vulnerability presents an immediate risk to any deployment of Pizzafy Ecommerce System 1.0. Organizations must prioritize restricting access to the administrative login interface and implement robust WAF filtering to mitigate the threat of unauthorized database access.