Frog CMS 0.9.5 has XSS via the /admin/?/user/add Name or Username parameter

gistfile1.txt

> [Vulnerability Type]
> Cross Site Scripting (XSS)
>
> ------------------------------------------
>
> [Vendor of Product]
> Frog CMS team
>
> ------------------------------------------
>
> [Affected Product Code Base]
> Frog CMS - 0.9.5
>
> ------------------------------------------
>
> [Affected Component]
> Frog CMS
>
> ------------------------------------------
>
> [Attack Type]
> Remote
>
> ------------------------------------------
>
> [Impact Code execution]
> true
>
> ------------------------------------------
>
> [Attack Vectors]
> Stored XSS
>
> ------------------------------------------
> Steps to reproduce:
1. Click to Add new user.
2. On page http://localhost/FrogCms/admin/?/user/add, add Name as "<script>alert(1)</script> and Username as "<img src=/ onerror=alert(2)>"
3. Click on Save
4. Javascript code executes on http://localhost/FrogCms/admin/?/user.
>
> [Discoverer]
> Prafull Agarwal