Fgetss

A cross-site request forgery issue exists where the `checkCsrf()` function in admin/controller/base.php only validates tokens for POST requests. This allows attackers to trick an authenticated administrator into executing forged GET requests to perform state-changing actions, such as deleting user accounts, sites, orders, and menus, or modifying comment statuses.

A stored cross-site scripting issue exists where low-privilege author or vendor users can inject scripts by bypassing the regex blacklist in the `sanitizeHTML()` function. This allows attackers to save post or product content containing unclosed event-handler tags or `javascript:` entities, which then execute for anonymous visitors and administrators, potentially leading to the theft of sessions or CSRF tokens.

A remote code execution issue allows users with restricted `site admin` roles to inject PHP code by saving `.sql` files via the admin code editor. This is achieved by using an `@IF` macro payload to bypass extension and content deny-lists. When the model loads, the payload compiles into executable PHP, enabling the execution of operating system commands with the privileges of the web user.