SeaCMS Cross-Site Scripting Vulnerability in admin_paylog.php

A cross-site scripting (XSS) vulnerability has been identified in SeaCMS version 13.2. The issue arises in the file admin_paylog.php, where the cstatus argument can be manipulated to inject malicious scripts. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the admin_paylog.php file with a crafted cstatus argument that includes the desired script payload. The injected script will be executed in the user's browser, demonstrating the cross-site scripting vulnerability.