phpwind has XSS vulnerability in default template
Tested through the demo site on the official website and found that the latest version is the same
url:http://demo.phpmywind.com/
Vulnerable URL:http://demo.phpmywind.com//goodsshow.php?cid=12&tid=10&id=1
Start the packet capture test：

Click to buy now

POST：
POST /shoppingcart.php?a=addshopingcart HTTP/1.1
Host: demo.phpmywind.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0
Accept: text/html, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Content-Length: 71
Origin: http://demo.phpmywind.com
Connection: keep-alive
Referer: http://demo.phpmywind.com/goodsshow.php?cid=12&tid=10&id=1

typeid=10&goodsid=1&buynum=1&attrid_1=%E9%BB%91%E8%89%B2&attrid_2=WCDMA

Modify the JavaScript statement of the parameter attrid_1
Successfully triggered