Johan Caluwe

The issue is related to the deserialization of untrusted data, which can lead to remote code inclusion. This allows a remote attacker to execute arbitrary code.

The issue allows for persistent XSS attacks through the user interface, requiring a trusted non-admin account. A vector exists due to the improper escaping of the banner image URL for external banners when displayed on most banner-related pages.

The issue affects the "www/admin/stats.php" endpoint, which is vulnerable to reflected XSS attacks. This is due to multiple parameters not being properly sanitised or escaped when displayed, including `setPerPage`, `pageId`, `bannerid`, `period start`, and `period end`.

The issue allows for persistent XSS attacks through the user interface, requiring a trusted non-admin account. A vector exists due to the website name not being properly escaped when displayed in the campaign-zone.php script.