Promote employee

<img src=x onerror=alert('HACKED')> is going to be promoted as a manager