Administrator session compromise via unsanitized title fallback

Stored XSS in Wuzhi CMS 4.1.0 allows remote attackers to run script in an administrator's browser through a guestbook post. Within myissue.php, ask() sanitizes an explicit title but truncates raw content when title is absent, storing the unsanitized fallback as the title. Exploitation requires an administrator to view the submitted message; the demonstrated consequence is theft of the administrator's session cookie.