Administrative session theft via stored checkout script

Stored XSS in SourceCodester Online Pizza Ordering System 1.0 allows remote authenticated users to inject script through checkout. The checkout order-submission path accepts attacker-controlled order data without neutralizing browser-executable markup and later renders the stored value to administrative users. A low-privileged account and an administrator viewing the submitted order are required, enabling script execution in the administrator's browser and theft of authenticated session context.