A problematic cross-site scripting (XSS) vulnerability has been identified in the Bookstore Management System, specifically affecting versions 1.0. This vulnerability resides within the processbookadd.php file, allowing attackers to inject malicious scripts through the manipulation of the 'Book Name' parameter. The vulnerability is exploitable remotely and has been publicly disclosed, requiring immediate attention to prevent potential data compromise. A patch is available in version 1.0.1.
Successful exploitation of CVE-2025-1174 allows an attacker to inject arbitrary JavaScript code into the Bookstore Management System. This code can then be executed in the context of a user's browser when they visit a page containing the injected script. The impact ranges from simple defacement of the website to more serious consequences, such as stealing user session cookies, redirecting users to malicious websites, or even gaining unauthorized access to sensitive data stored within the application. The remote nature of the vulnerability means an attacker does not need to be on the same network as the server to exploit it, significantly expanding the potential attack surface. While the CVSS score is LOW, the ease of exploitation and potential for user data compromise warrants prompt remediation.
This vulnerability has been publicly disclosed, increasing the likelihood of exploitation. No specific KEV listing or EPSS score is currently available. The public disclosure of the vulnerability and the availability of the affected component suggest a moderate risk of exploitation, particularly if the system is exposed to the internet without adequate security controls. The vulnerability was published on 2025-02-11.
Exploit Status
EPSS
0.09% (26% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-1174 is to upgrade the Bookstore Management System to version 1.0.1, which includes the necessary fix. If an immediate upgrade is not possible, consider implementing input validation and output encoding on the 'Book Name' parameter within the processbookadd.php file. Specifically, sanitize user input to remove or escape any potentially malicious characters before displaying it on the page. Web Application Firewalls (WAFs) configured to detect and block XSS attacks can provide an additional layer of protection. Review and update any existing security policies to reflect this vulnerability and reinforce secure coding practices.
Update the Bookstore Management System to a patched version or implement input sanitization measures in the process_book_add.php file, especially for the Book Name parameter. Escaping or validating user input before displaying it on the web page will prevent XSS (Cross-Site Scripting) code execution. Consider also applying an input filter to remove or encode special characters.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-1174 is a cross-site scripting (XSS) vulnerability affecting versions 1.0 of the Bookstore Management System. It allows attackers to inject malicious scripts through the 'Book Name' parameter in processbookadd.php.
You are affected if you are using Bookstore Management System version 1.0. Upgrade to version 1.0.1 to mitigate the vulnerability.
The recommended fix is to upgrade to version 1.0.1. Alternatively, implement input validation and output encoding on the 'Book Name' parameter.
While no active exploitation has been confirmed, the vulnerability has been publicly disclosed, increasing the risk of exploitation.
Refer to the vendor's official website or security advisory channels for the Bookstore Management System for the latest information and updates regarding CVE-2025-1174.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.