Peter Stiehl

The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as an attachment to a new ticket and then accessing it directly. This is achieved by adding the file to files/ tmp/ and then making a direct request to the file.

The issue allows remote authenticated users to create super-admin accounts. This is achieved by leveraging permissions to create a user and the ` profiles id` parameter to the "front/user.form.php" endpoint.