Fix mistake in the BRLY-2023-012 exploitation steps section

Supermicro/BRLY-2023-012.md

@@ -63,7 +63,7 @@ As a result, arbitrary JavaScript code can be injected into webpages, which will
 
 ## Steps for exploitation
 
-The first step to exploit this vulnerability is to poison the user's `language` session cookie. This can be achieved using another vulnerability in the web server (with XSS, HTTP header injection, etc.), as well as through exploitation of other system components, for example, with a malware.
+The first step to exploit this vulnerability is to poison the `lang` local storage item. This can be achieved using another vulnerability in the web server (e.g. with XSS), as well as through exploitation of other system components, for example, with a malware.
 
 To create an administrator account with username `BRLY` and password `BRLYBRLY` an attacker can poison the `lang` local storage item of an authenticated user session with administrative privileges with the following payload: