View log details Reflected-XSS vulnerabilities in the background.

[zhujieta0]

Which version of FeehiCMS do you tesing?

v2.1.1

Expected behavior

View log details

Actual behavior

View log details Reflected-XSS vulnerabilities in the background of FeehiCMS .

Steps to reproduce the behavior

{
URL：http://127.0.0.1:8080/feehicms/frontend/web/admin/index.php?r=log%2Fview-layer
POC:%3Csvg%20onload=alert(20221014)%3E
}

1. register a user for testing.

2. go to Content -> Log Page, open one loginfo to view details.
   

3. find id parameter in url and Insert poc after the id.
   （The page automatically loads and triggers XSS.）