autumn-cms add user has XSS vulnerabilities

[niuzhi]

Location：cms后台登陆，系统设置->用户管理->添加用户->登录名

POC:登录名:<script>alert("hack123")</script>

后台代码未进行输入过滤：
@RequestMapping(value = "insert/")
@responsebody
public ResponseMsg insertUser(User user){

    user.setPassword(MD5Util.getMD5(user.getPassword()));
    return userService.insertUser(user);
}