XSS on login page

[Xitro01]

Describe the bug/issue
The parameter data[performredirect] on the login page is vulnerable to XSS attacks.
This issue was found in the latest Docker package by jgeusebroek (jgeusebroek/docker-spotweb) and seems to involve the latest Spotweb 1.5.1 as random Spotweb servers on the internet are also vulnerable.

To Reproduce
Steps to reproduce the behavior:
Go to this URL: http://[ip]:[port]/?data[performredirect]=%22%3E%3Cscript%3Ealert(0)%3C/script%3E&page=login

Screenshots

[Xitro01]

I'm afraid that it's still possible. I get the "Script is not allowed" alert, but after that it will simply execute my XSS.

I'm using the following payload:
http://192.168.1.7:8081/?data[performredirect]=%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E&data[renderhtml]=1&loginform[http_referer]=https%3a%2f%2f192.168.1.7%3a8081%2f%3f&page=login&loginform[xsrfid]=1687430765%3aloginform%3a1%3acf7767e526ef26267fa6e655d069f16a653fe95f&loginform[username]=&loginform[submitlogin]=Login&loginform[password]=

My advice:
User input must be HTML encoded at every point where it is copied into the application's response. All HTML characters, including <> "" 'and =, must be replaced with corresponding HTML entities (< > etc).

[mesa57]

Feel free to submit a PR

[Xitro01]

Feel free to submit a PR

To be honest, I would if I could. Yet I spend hours and hours developing my offensive security skillset and little time in my programming skills. Despite that I still felt it was my duty to report this issue.