The vulnerability exists in the save_menu function of the /admin/admin_class_novo.php file within SourceCodester Pizzafy Ecommerce System version 1.0. By manipulating the img parameter, an attacker with high privileges can bypass file extension restrictions and upload arbitrary files remotely. This unrestricted upload flaw could lead to further compromise depending on the uploaded content. The CVSS 4.0 base score is 5.1, reflecting medium severity with network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. No official patch or remediation level has been provided by the vendor as of the publication date.

An attacker with high privileges can remotely upload arbitrary files without restriction, potentially leading to unauthorized code execution or system compromise depending on the uploaded payload. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted administrators only and monitor for suspicious file uploads. Avoid exposing the admin interface to untrusted networks. Follow vendor updates for any forthcoming patches or mitigations.