There is xss in the front desk which can get hazards such as administrator cookies

[Jayway]

1、Build an environment to simulate users selecting products at the front desk——add to cart——confirm order-pay：
http://127.0.0.1:28089/shop-cart/settle
Insert the payload here at the harvest information:

<script> alert (document.cookie)  2、When the administrator logs in to the background, XSS will be triggered when viewing the "View Recipient Information" of this order in the "Order Management Office" 

[Jayway]

Add a screenshot：