Donglight Bookstore Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Donglight Bookstore version 1.0.0. The issue arises in the BookSearchList function within the BookInfoController.java file, where the input parameter 'keywords' is not properly sanitized. This lack of input validation allows remote attackers to inject malicious scripts that are executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser session.

Reproduction

To reproduce this vulnerability, send a request to the 'book/list' endpoint with the 'keywords' parameter containing a script tag, such as '<script>alert(1)</script>'. The injected script will be executed in the browser, demonstrating the cross-site scripting vulnerability.