Johan Caluwe

O problema está relacionado à desserialização de dados não confiáveis, o que pode levar à inclusão remota de código. Isso permite que um invasor remoto execute código arbitrário.

The issue allows for persistent XSS attacks through the user interface, requiring a trusted non-admin account. A vector exists due to the improper escaping of the banner image URL for external banners when displayed on most banner-related pages.

The issue affects the "www/admin/stats.php" endpoint, which is vulnerable to reflected XSS attacks. This is due to multiple parameters not being properly sanitised or escaped when displayed, including `setPerPage`, `pageId`, `bannerid`, `period start`, and `period end`.

The issue allows for persistent XSS attacks through the user interface, requiring a trusted non-admin account. A vector exists due to the website name not being properly escaped when displayed in the campaign-zone.php script.