code-projects 在线书店 booklist.php 跨站脚本漏洞

An attacker can exploit this XSS vulnerability by crafting a malicious URL containing a specially crafted 'subcatnm' parameter. When a user clicks on this link, the injected script will execute within their browser context, under the user's privileges. This could allow the attacker to steal session cookies, redirect the user to a phishing site, or deface the website. The impact is limited to the user interacting with the malicious link, but the consequences can be severe, including account compromise and data theft. The vulnerability's location within a book listing page suggests a potential attack vector targeting users browsing the online store.

Users of Online Book Shop version 1.0 are directly at risk. Shared hosting environments where multiple websites share the same server resources are particularly vulnerable, as an attacker could potentially compromise other websites hosted on the same server if they can exploit this vulnerability.

• php / web:

grep -r 'subcatnm' /var/www/html/booklist.php | grep -i '<script'

• generic web:

curl -I 'http://your-online-book-shop.com/booklist.php?subcatnm=<script>alert(1)</script>' | grep 'Content-Type' # Check for script execution

1. 2025-01-07Disclosure

   disclosure

1. 已保留2025-01-07
2. 发布日期2025-01-07
3. 修改日期2025-08-26
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2025-0295 is to upgrade to version 1.0.1 of Online Book Shop, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the 'subcatnm' parameter in /booklist.php. This should include escaping any potentially harmful characters before rendering the parameter in the HTML output. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide an additional layer of protection. Review and update any existing security policies to address XSS vulnerabilities.