AnqiCMS | Multiple XSS vulnerabilities via document text editor

AnqiCMS uses a text editor for creating pages. This text editor is used in various places to make it easy for admins to design pages. Some endpoints where this text editor is used are the following endpoints:

/system/archive/list
/system/archive/category
/system/archive/tag
/system/archive/page

All of these endpoints are vulnerable to XSS because they use the same editing software & code. At first it seems like authenticated moderators should be able to make these modifications but these pages are designed for editing text not adding JavaScript.

Reproduce

Navigate to [/system/archive/list], click “Revise” button for any of the posts you see in there and you may get redirected to a URI like this:

http://127.0.0.1:8001/system/archive/detail?id=48

Inside the editor, there is a button called “Code”, if you hover your mouse on it, you will notice it.

Remove existing code and add the following JS code:

<script>alert("Popup!")</script>

Click on submit and visit the document using its link, for me, it was the following link:

http://127.0.0.1:8001/mo-chuang/48.html