CSS Injection to CSRF to Privilege Escalation to Admin PoC