CVE-2018-12290: Yii2-StateMachine extension for Yii2 XSS Vulnerability

The exploit demonstrates XSS via the 'role' parameter, indicating insufficient input sanitization. In Yii2, XSS typically occurs when user-controlled data (like $_GET parameters) is rendered in views without escaping. While the exact functions/files aren't specified in advisories, the role parameter's involvement suggests vulnerabilities in controller actions handling input and view templates rendering it. Confidence is medium due to the lack of explicit code references but strong contextual alignment with Yii2 XSS patterns.