The functionality at this point is susceptible to XSS
![](https://foruda.gitee.com/images/1719751584836080152/2c6a4f53_14624729.png "屏幕截图")
poc:<script>alert(/xss/)</script>
After the pass-in is passed, the admin user accesses the /admin/guestbook page to trigger XSS
![](https://foruda.gitee.com/images/1719751879041516923/e8b5818c_14624729.png "屏幕截图")
![](https://foruda.gitee.com/images/1719752086432574792/83a043f6_14624729.png "屏幕截图")