Xujiangfei Admintwo Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Xujiangfei Admintwo version 1.0. The issue arises from the '/ztree/insertTree' endpoint, where the 'name' parameter can be manipulated to inject malicious scripts. This vulnerability can be exploited remotely, and the injected script is executed after the knowledge base entry is reviewed and approved.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, send a POST request to the '/ztree/insertTree' endpoint with a payload that includes a script tag in the 'name' parameter. After the request is processed, the injected script will execute when the knowledge base entry is accessed after approval.