Design/Logic Flaw

An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the pagelist "attached" attribute which typically has 'class="icon-globe icon-large"' in its value, as demonstrated by an 'UPDATE sysmodule SET attached = "XSS" WHERE id="pagelist"' statement...