Stored XSS in Geeklog v2.2.2

Geeklog v2.2.2 is vulnerable to Stored Cross-Site Scripting (XSS) in public_html/admin/router.php

Vendor:https://github.com/Geeklog-Core/geeklog

PoC

1. Log in to the Geeklog's admin account and Navigate to URL Routing and click an Edit button.

2. Enter the payloads to the input areas of Rule and Route. Then click on SAVE. The payloads are

<script>alert('xss_rule');</script>
<script>alert('xss_route');</script>

3. We can observe the payloads getting triggered. Multiple visits to the routing manager page will still trigger payloads.