Rambo

There is a CSRF vulnerability that can add the administrator account

2

After the administrator logged in, open the following page to add an administrator. poc： history.pushState('', '', '/')