A full walkthrough of how a manufacturing dashboard’s client-side authentication model collapsed under a single Burp rule, and how that access chained directly into stored HTML injection across shared pages.