Stored XSS via invoice description sanitizer bypass

Stored XSS in the Invoice Edit Page in Bitrix24 22.0.300 allows remote authenticated users to execute JavaScript in a victim's browser. The invoice component skips USER_DESCRIPTION sanitization when a less-than sign occurs at offset zero, while a paragraph-separator transformation later restores a valid HTML event handler before the editor writes the stored value into the document. Exploitation requires CRM access and invoice permissions plus a victim opening the affected invoice; an administrator victim also exposes the built-in PHP command feature to server-command execution.