Paradisecongo

An issue was discovered in the system, where there is a CSRF vulnerability in the `member email.php` file, specifically when the `action` parameter is set to `edit`.

An issue allows modification of an email address between the request for a validation code and the entry of the validation code. This can lead to storage of an XSS payload contained in the modified address.

The issue is related to SQL injection via the `type` parameter in the "member/member order.php" endpoint, specifically involving the `O state` parameter.

The issue arises from a discrepancy in `username` checking between two components, one performing string validation and the other querying a MySQL database. This discrepancy allows for the registration of a new account with a duplicate `username`, as shown by using the `test%c2` string when a `test` account already exists.