Date of Report: 24 / 3 / 2024

Description

Attackers can register accounts whose first name, last name, or username contain malicious scripts.
These payloads execute later when admins search or list users.

Impact

• Admin session hijack & privilege escalation
• System‑wide malware injection
• Data exfiltration

Proof of Concept

https://www.youtube.com/watch?v=7_0WgRv_sok

Affected Component

User registration logic (modules/auth/). Admin panel logic (modules/admin/).

Mitigation

Sanitize/encode user attributes before storage and when rendering.