stored Blind XSS in Admin Panel through FAQ-Proposal leads to Admin Full Account Takeover

Hello.

Vulnerability: Blind XSS in Admin Panel while generating Report

1. Without beeing logged in the Application
2. Go to FAQ-Proposal -> put an XSS Payload like <script>alert(‘1’)</script> in the question Field
3. Send the Proposal

4. Admin will login
5. The Proposal will pop up in the Category you specified while sending your Proposal here number 1
   6 Admin will go to Statistics and then Reports
6. Generate Report
7. Blind XSS will be fired in the Admin Panel

Steal the Admin Cookies and do a Full Account Takeover of the Admin Account.

Best regards
Ahmed Hassan