Pizzafy Ecommerce System EUVD-2026-45436

Exploitation requires an active session authenticated as an administrator (PR:H per CVSS 4.0 vector), meaning the attacker must first obtain valid admin credentials - this is a hard prerequisite and the primary limiting factor. The vulnerable code path is specifically the save_settings function in /admin/admin_class_novo.php invoked via a POST request with the img argument. The application must be running SourceCodester Pizzafy Ecommerce System 1.0 on a PHP-capable web server accessible over the network (AV:N). For the most impactful outcome (remote code execution via webshell), the upload destination directory must be web-accessible and the web server must execute PHP scripts within it - this is a non-default safety failure but common in misconfigured shared hosting environments. Exploitation is not possible without prior authentication as an administrator; no privilege escalation path from lower roles is described in available data.

The CVSS 4.0 score of 5.1 with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L reflects that exploitation is constrained by the PR:H requirement - an attacker must already hold administrator credentials before abusing this flaw. This substantially narrows the realistic attack surface and distinguishes it from high-severity unauthenticated file upload vulnerabilities. The conservative VC:L/VI:L/VA:L impact ratings in the provided CVSS 4.0 vector appear to understate actual exploitation potential: successful webshell delivery typically results in full server compromise rather than limited impact, a discrepancy worth flagging when triaging. No EPSS data was supplied; given the niche product footprint and PR:H gate, exploitation probability is expected to be low in the broader ecosystem. There is no CISA KEV listing and no confirmed public exploit code, reinforcing this as a lower-urgency finding absent evidence of targeting. The key risk amplifier is whether the upload destination is web-accessible with PHP execution enabled - defenders should verify this configuration before deprioritizing.

An attacker who has obtained administrator credentials through credential stuffing, phishing, or a previously compromised account authenticates to the Pizzafy admin panel and submits a crafted multipart/form-data POST request to /admin/admin_class_novo.php with the img field set to a PHP webshell (e.g., <?php system($_GET['cmd']); ?>). If the server stores the file in a web-accessible directory without PHP execution restrictions, the attacker retrieves the uploaded file's public URL and sends an HTTP GET request with a cmd parameter to execute arbitrary OS commands as the web server user. No public exploit code has been confirmed at time of analysis, though the technique is elementary for any attacker familiar with PHP file upload exploitation.