This vulnerability in artanik's 'Hack me if you can' product (versions up to 1.2) involves a CSRF flaw that enables stored XSS attacks. An attacker can exploit the CSRF weakness to cause a victim to unknowingly execute malicious requests, which results in stored XSS payloads being injected and executed in the context of the application. The CVSS 3.1 score of 7.1 indicates a high-severity issue with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability with scope changed.

Successful exploitation can lead to stored XSS, which may allow attackers to execute arbitrary scripts in users' browsers, potentially stealing sensitive information, performing unauthorized actions, or disrupting service. The CSRF aspect means attackers can trick authenticated users into submitting malicious requests, increasing the risk of compromise. The combined effect impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate risk. Monitor vendor channels for updates and apply official fixes once released.