Code-Projects Online Book Shop Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Code-Projects Online Book Shop version 1.0. The issue arises in the file '/booklist.php' when the 'subcatnm' parameter is manipulated. This vulnerability allows remote attackers to inject malicious scripts, which are then executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the user's browser, potentially leading to the theft of cookies or session tokens.

Reproduction

To reproduce this vulnerability, send a request to '/booklist.php' with 'subcatid' set to '1' and 'subcatnm' containing the injected script, such as an image tag with an 'onerror' event.