PT-2025-6154 · Unknown · 1000 Projects Bookstore Management System

Neo-O · Published 2025-02-11 · Updated 2025-02-28 · CVE-2025-1174

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: 1000 Projects Bookstore Management System version 1.0

Description: A vulnerability has been found in the Add Book Page component, specifically in the file process book add.php. The manipulation of the Book Name argument leads to cross-site scripting. The attack can be initiated remotely. Other parameters might be affected as well.

Recommendations: For 1000 Projects Bookstore Management System version 1.0, consider disabling the process book add.php file or restricting access to the Add Book Page component until a patch is available. As a temporary workaround, avoid using the Book Name argument in the affected page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-1174

Affected Products

1000 Projects Bookstore Management System

References · 12

• 🔥 https://github.com/NeoVuln/CVE/issues/3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1174 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1174 · Vendor Advisory
• https://t.me/cvenotify/112743 · Telegram Post
• https://vuldb.com/?ctiid.295078 · Note
• https://twitter.com/VulmonFeeds/status/1889294252582085029 · Twitter Post
• https://t.me/cvenotify/110750 · Telegram Post
• https://vuldb.com/?id.295078 · Note
• https://t.me/cvedetector/17658 · Telegram Post
• https://twitter.com/CVEnew/status/1889181116273504549 · Twitter Post
• https://1000projects.org · Note
• https://vuldb.com/?submit.495318 · Note