CoffeeW CoffeeW-1337

## gist:b93223b7507e0d43d764a70eba00473b
CVE-2019-13583
An issue was discovered in Xtream Codes 1.60.0. It is an XSS chained with
CSRF, leading to remote command execution as the payload is
stored on a page that is frequently viewed by an admin.

[Additional Information]
A captcha bypass is needed if scripted, a fast function with selenium works well.

The attacker inject the payload which will be reflected in a page.
With social engineering the attacker can push the admin to go to the
	CVE-2019-13583
	An issue was discovered in Xtream Codes 1.60.0. It is an XSS chained with
	CSRF, leading to remote command execution as the payload is
	stored on a page that is frequently viewed by an admin.

	[Additional Information]
	A captcha bypass is needed if scripted, a fast function with selenium works well.

	The attacker inject the payload which will be reflected in a page.
	With social engineering the attacker can push the admin to go to the