CSRF to XSS in /htdocs/modules/system/admin.php