h1-ctf: [h1-415 2020] Multiple chained vulnerabilities lead to leaking secret document

Multiple chained vulnerabilities lead to leaking secret document. Improper sanitization in registration allows attacker to create a QR recover code for any email address. Using that technique, attacker can access support chat functionality, which is vulnerable to Blind XSS. This leaks an admin page that can change the name of any user, allowing an attacker to run a malicious payload through the PDF converter to leak secret documents