Chaining file upload bypass and stored XSS to create admin accounts

Two medium-severity findings chained into full admin compromise on a SaaS pen test. Attack walkthrough, Docker PoC lab, and fixes.