Administrator session theft via stored registration XSS

Stored XSS in Simple Customer Relationship Management System 1.0 allows remote attackers to steal administrator sessions via a crafted name. The registration handler stores the name field without effective neutralization, and the Users view renders it as active markup in an administrator's browser. An attacker needs only submit a registration, but exploitation requires an administrator to open the Users tab; the demonstrated payload exfiltrates the administrator's session cookie.