CSRF XSS CSRF RCE protection

Hello,
I've just found an HTTP vulnerability in my server UCP, anyone can use a POST method (form) and inject the code with it, so he will be able to ban or kick anyone in the server, if anyone knows how to block this injection method please help. I'm not experienced with web security at all.