Executive brief
A security vulnerability exists in the Pizzafy Ecommerce System, a web application used for managing online pizza orders. An attacker with administrative access can inject malicious scripts into the system's menu management section. If another user views the affected page, the script could execute in their browser, potentially leading to unauthorized actions or information disclosure within the application.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Pizzafy Ecommerce System 1.0. The flaw is located in the 'save_menu' function within /admin/ajax.php. An attacker with high privileges (admin) can manipulate the 'Name' argument to inject arbitrary JavaScript. This script is then stored on the server and executed in the context of any user who subsequently views the menu. The attack requires network access and administrative credentials, and relies on a victim interacting with the malicious content. A public exploit (PoC) has been disclosed.
Affected products
- SourceCodester Pizzafy Ecommerce System 1.0
Timeline
- 2026-04-28: disclosed: Exploit disclosed to the public.
- 2026-04-28: advisory: Initial disclosure via VulDB and NVD.