Stored XSS in Index

[ngochieu-kiminawa]

Describe the bug
Cross Site Scripting (XSS) via save Exclude URLs

To Reproduce
Steps to reproduce the behavior:

1. Login to flatcore CMS
2. Click on 'Create new Page' after click 'Index'
3. Insert into a XSS payload in Exclude URLs
4. And XSS save on : http://domain/acp/acp.php?tn=pages&sub=index
   Screenshots
   
   XSS payload

<script>alert(1)</script>

Desktop (please complete the following information):

• OS: all
• Browser : all
• Version : all

Additional context
The XSS attack will help the hacker get the login session of other users requiring them to have at least one "Create new Pages" permission.

[ngochieu-kiminawa]

@patkon
Can you help me check issue this?
Looking forward to hearing from you.
Thank.

[patkon]

I'll fix that as soon as possible.