Cross Site Scripting Vulnerability in GetSimple CMS v-3.3.16 admin/edit.php

[takabaya-shi]

Hi, I would like to report Cross Site Scripting(XSS) Vulnerability in latest release(3.3.16) admin/edit.php.
STEPS TO REPRODUCE:

1. Login to GetSimple CMS as admin
2. Open the URL http://localhost/admin/pages.php
3. Click on Create New Page button then it will be redirected to http://localhost/admin/edit.php
4. enter the malicious javascript </h1><h2>xss</h2><iframe src='data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=' < into Add New Page parameter and add some text in body part then save the page.
   PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=is base64 encode <script>alert('XSS')</script>.
5. Now view that page by clicking on view button, xss will be get executed and XSS will be reflected on the browser.

PROOF OF CONCEPT:
1 enter the malicious javascript </h1><h2>xss</h2><iframe src='data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4=' <

2 save updates

3 view that page by clicking on view button, xss will be get executed