Fengxun dotNETCMS 1.0 SP5 XSS vulnerability and repair

Brief description: XSS vulnerability because the program does not filter user submitted data.
Detailed Description: vulnerability file: stat/mystat. aspx

Document. write ("<script> var code = '<% = code %>'; var url = '<% = str_fs_url %> '; var statid = '<% = statid %>' </script> ")
Code is not filtered to generate XSS vulnerabilities
Proof of vulnerability: http://www.foosun.net/stat/mystat.aspx? Code = '</script> ") <iframe src = 'HTTP: // www.baidu.com' width = '000000' height = '000000' frameborder = no border = 0>

You don't need to say too much, you know.
Solution: temporary solution: filter the code and id.
Wait for fengxun to fix the vulnerability.