SourceCodester Pizzafy Ecommerce System EUVD-2026-26138

Exploitation requires the attacker to either: (1) be an authenticated administrator with high privileges (PR:H), or (2) trick a high-privilege administrator into visiting a crafted link (UI:P - user interaction prerequisite). The vulnerability is not exploitable by anonymous users or low-privilege accounts. The /admin/index.php?page=save_settings endpoint must be accessible and must process the Name parameter without output encoding. The exploit is limited to reflected/stored XSS in the admin context, not to other user roles or the public-facing shop. No indication of default configuration bypass; the high privilege requirement is inherent to the admin panel.

CVSS 4.8 with PR:H (high privilege required) and UI:P (user interaction required) indicates moderate but non-critical risk. The CVSS vector shows integrity impact (VI:L) only, not confidentiality or availability compromise, and no scope change (S:X/unspecified). EPSS data is not provided. The publicly available exploit code (E:P in CVSS) increases practical risk moderately. Real-world threat depends heavily on environment: in a small business with few trusted admins, risk is low; in larger organizations with contractor or compromised admin accounts, risk is elevated. This is NOT a critical vulnerability despite PHP and XSS tags - the high privilege requirement and user interaction substantially reduce the attack surface compared to unauthenticated remote XSS. No KEV (CISA Known Exploited Vulnerabilities) listing is indicated, suggesting limited active widespread exploitation.

An attacker with or who has compromised an administrator account crafts a malicious URL containing JavaScript in the Name parameter (e.g., /admin/index.php?page=save_settings&Name=<img src=x onerror=alert('XSS')>) and tricks or socially engineers another administrator into clicking the link. When the target admin views the saved settings or the page processes the Name parameter, the JavaScript executes in their browser session, potentially stealing session cookies, performing unauthorized admin actions, or redirecting to a phishing site.