Executive brief
SourceCodester Pizzafy Ecommerce System 1.0 contains a security flaw in its order processing component. An attacker with administrative access can inject malicious scripts into the 'first_name' field when saving an order. If another user views this data, the script could execute in their browser, potentially leading to unauthorized actions or information disclosure within the application.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Pizzafy Ecommerce System 1.0. The vulnerability is located in the 'save_order' function within the '/admin/ajax.php' file, specifically triggered by insufficient sanitization of the 'first_name' argument. A remote attacker with high privileges (PR:H) can submit a crafted request containing malicious JavaScript. When an administrator or another user views the saved order details, the payload executes in their browser. This is classified as CWE-79 and CWE-94. A public proof-of-concept (PoC) exists, though no official patch has been confirmed.
Affected products
- SourceCodester Pizzafy Ecommerce System 1.0
Timeline
- 2026-04-28: disclosed: Vulnerability disclosed and CVE assigned
- 2026-04-28: advisory: NVD and VulDB published advisory details