Executive brief
SourceCodester Pizzafy Ecommerce System 1.0 is an online platform for managing pizza sales. A security flaw in the user management section allows an attacker with administrative access to inject malicious scripts into the system. If another user views the affected page, these scripts could execute in their browser, potentially leading to unauthorized actions or data theft within the application.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Pizzafy Ecommerce System 1.0 within the save_user function of /admin/ajax.php. The vulnerability is triggered by insufficient sanitization of the 'Name' argument when the action is set to 'save_user'. A remote attacker with high privileges (PR:H) can inject malicious JavaScript that executes when other users (typically administrators) interact with the user management interface. This requires user interaction (UI:R) to trigger the payload. While the CVSS score is low due to the high privilege requirement, the exploit code has been publicly disclosed.
Affected products
- SourceCodester Pizzafy Ecommerce System 1.0
Timeline
- 2026-04-28: disclosed: Vulnerability disclosed and CVE assigned.
- 2026-04-28: advisory: Initial publication by VulDB/NVD.