xxl-api v1.3.0及以下版本，项目管理、数据类型管理、业务线管理及用户管理等模块存在跨站脚本攻击漏洞，以下仅展示业务线管理模块中的漏洞利用，其余模块均可参照此步骤复现（Xxl-api v1.3.0 and below, there are cross-site script attack vulnerabilities in modules such as project management, data type management, business line management and user management. The following only shows the exploit of vulnerabilities in the business line management module, and the rest of the modules can be reproduced by referring to this step. ）
拉取最新的代码，本地部署运行。（Pull up the latest code and run it on-premises.）
登录系统后，在业务线管理模块中新增业务线操作，在业务线名称字段中插入xss的poc。（After logging in to the system, add a line of business operation to the Business Line Management module and insert the POC of XSS in the Business Line Name field.）
保存数据（Save data）
进入业务线管理模块，触发poc（Go to the Business Line Management module and trigger the POC）
https://github.com/xuxueli/xxl-api
xxl-api ≤ v1.3.0