Administrative privilege escalation via template injection

Client-side template injection in Azuriom CMS before 1.2.7 allows remote authenticated users to execute code in an administrator's browser. An admin-dashboard component renders low-privilege user input as template expressions that fetch and evaluate attacker-hosted JavaScript. Exploitation requires a low-privilege account and an administrator session rendering the content; the published proof of concept extracts a CSRF token and creates an administrative user.