I found a storage XSS vulnerability in pages that add news
在普通用户和游客身份发布新闻会被实体化编码，而用admin账号去做xss就可以逃逸达到存储型xss的目的
Publishing news on the identity of ordinary users and tourists will be entirely coded, and using admin account to do XSS can escape to achieve the purpose of storage xss.
Next, prove the vulnerability
Click Modify
Enter the script we built and click Submit
Bombs found after submission
I found a storage XSS vulnerability in pages that add news
在普通用户和游客身份发布新闻会被实体化编码，而用admin账号去做xss就可以逃逸达到存储型xss的目的
Publishing news on the identity of ordinary users and tourists will be entirely coded, and using admin account to do XSS can escape to achieve the purpose of storage xss.
Next, prove the vulnerability
Click Modify
Enter the script we built and click Submit
Bombs found after submission
