The SourceCodester Pizzafy Ecommerce System 1.0 is vulnerable to an unauthenticated SQL injection attack that allows for full database compromise.

This vulnerability is an error-based SQL injection (CWE-89) located in the id parameter of the /admin/ajax.php endpoint. The application fails to sanitize user-supplied input before incorporating it into a database query, allowing an unauthenticated attacker to inject malicious SQL commands and extract sensitive information.

The exploitation of this vulnerability poses a severe risk to organizational data and system integrity. Because the flaw allows for the extraction of database schemas, user credentials, and password hashes, it could lead to unauthorized administrative access, full data exfiltration, or complete system compromise. Given the CVSS score of 7.3, this issue presents a high risk to the confidentiality and integrity of the affected ecommerce environment.

Immediate Action: As no vendor patch is currently available, administrators should immediately disable the vulnerable functionality or restrict access to the /admin/ directory to trusted internal networks only. Developers must refactor the code to utilize prepared statements with parameterized queries instead of concatenating user input directly into SQL strings.

Proactive Monitoring: Security teams should monitor web server and database logs for anomalous query patterns, such as the use of SQL syntax characters or error-based injection functions like extractvalue in GET requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the id parameter in URI strings.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced technical submission on GitHub.

The severity of this SQL injection vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate action. Administrators must restrict access to the affected components or take the application offline until a secure version is developed and deployed. Priority should be given to implementing prepared statements to fully remediate the underlying flaw.