Stored xss vulnerability exists in order evaluation(订单评价存在XSS漏洞)

[Me7eorite]

How to reproduce steps(如何复现)

Build the project and use admin/123456 to log in and create several test data(搭建项目使用admin/123456登陆创建几条测试数据)

Create an ordinary user and click on a product we created to buy(创建一个普通用户随便点击一个我们创建的商品购买)
For the convenience of testing, a free purchase function is provided. Click it(为了方便测试提供了一个免费购买的功能,)

First, check my own order, then select the order we just purchased, click to ship by yourself, and finally click to confirm receipt(首先查看我自己的订单其次选择我们刚才购买的订单点击自己发货最后点击确认收货)

Use the evaluation function,insert poc <script>alert("undefined123")</script> (使用评价功能,插入poc)

受影响的版本

S-mall-ssm: lastest
OS：Windows/Linux/macOS
Browser: Chrome、Firefox、Safair