This vulnerability exists in the administrative control panel component of SourceCodester Pizzafy E-Commerce System 1.0, specifically in the Login function located in /admin/admin_class_novo.php. An attacker can remotely exploit the SQL injection flaw by manipulating the Username argument, potentially allowing unauthorized database access or manipulation. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No vendor advisory or patch information is currently available, and the exploit is publicly known.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database via the administrative login interface. This may lead to unauthorized data access, modification, or other database impacts. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, reflecting a medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the administrative control panel, implement web application firewall rules to detect and block SQL injection attempts targeting the Username parameter, and consider additional input validation or parameterized queries if source code access and modification are possible.