XSS vulnerability stored in the publish blog module of Jfinal_cms V5.1.0

[arongmh]

There is a stored XSS vulnerability in JFinal_cms 's publish blog module. An attacker can insert malicious XSS code into the keyword field. When the user views the content of the article in the foreground, the malicious XSS code is triggered successfully.

payload: " onmouseover="alert(document.cookie)

Successfully executed malicious XSS code:

[bharathmohanraj]

Fix for this issue #39 is available in pull request #44 https://github-com.translate.goog/jflyfox/jfinal_cms/pull/44