SourceCodester Pizzafy Ecommerce System 1.0 contains an SQL injection vulnerability in the Category function located in pizza/index.php?page=category. By manipulating the ID parameter, an attacker can inject SQL code remotely without requiring user interaction or elevated privileges. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and limited impact on confidentiality, integrity, and availability. No official patch or fix has been published, and the system is not a cloud service, so remediation depends on vendor or user action.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited scope and partial impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should consider implementing temporary mitigations such as input validation, parameterized queries, or web application firewalls to block malicious SQL injection attempts until an official patch is released.