The vulnerability is an unauthenticated SQL injection in the login function of admin_class_novo.php, which allows a remote attacker to send crafted input through the Username field. Based on the description, it is inferred that no prior authentication is required to exploit the injection, as the vulnerability occurs in the login process itself. The injection can modify or retrieve data from the underlying database, potentially leading to unauthorized disclosure, alteration, or in worst case escalation to further exploitation if additional code execution is possible. The flaw derives from the lack of proper input validation and quoting, as identified by CWE-74 and CWE-89.

SourceCodester Pizzafy E‑Commerce System, version 1.0. The vulnerability exists in the Administrative Control Panel component and specifically in the /admin/admin_class_novo.php file used for user authentication.

The CVSS base score of 6.9 indicates moderate severity with remote access and exploitation potential. EPSS data is unavailable so the likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Attackers can reach the vulnerable endpoint from the public Internet, making the risk significant for exposed installations. Because authentication is not required to trigger the injection, any unauthenticated user can exploit this flaw once the endpoint is reachable. The public exploit demonstrates that the flaw can be leveraged in the wild, so organizations should treat it as an active threat.