CVE-2025-1174

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-1174
A vulnerability has been found in 1000 Projects Bookstore Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file process_book_add.php of the component Add Book Page. The manipulation of the argument Book Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

2.4 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

3.3 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:L/Au:M/C:N/I:P/A:N

Exploitability : 6.4 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://1000projects.org/ Product
https://github.com/NeoVuln/CVE/issues/3 Exploit Third Party Advisory
https://vuldb.com/?ctiid.295078 Permissions Required VDB Entry
https://vuldb.com/?id.295078 Third Party Advisory VDB Entry
https://vuldb.com/?submit.495318 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:1000projects:bookstore_management_system:1.0:*:*:*:*:*:*:*
History

28 Feb 2025, 02:17

Type Values Removed Values Added
Summary
  • (es) Se ha encontrado una vulnerabilidad en 1000 Projects Bookstore Management System 1.0 y se ha clasificado como problemática. Esta vulnerabilidad afecta al código desconocido del archivo process_book_add.php del componente Add Book Page. La manipulación del argumento Book Name provoca Cross-Site Scripting. El ataque se puede iniciar de forma remota. La vulnerabilidad se ha hecho pública y puede utilizarse. También pueden verse afectados otros parámetros.
CPE cpe:2.3:a:1000projects:bookstore_management_system:1.0:*:*:*:*:*:*:*
First Time 1000projects bookstore Management System
1000projects
References () https://1000projects.org/ - () https://1000projects.org/ - Product
References () https://github.com/NeoVuln/CVE/issues/3 - () https://github.com/NeoVuln/CVE/issues/3 - Exploit, Third Party Advisory
References () https://vuldb.com/?ctiid.295078 - () https://vuldb.com/?ctiid.295078 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.295078 - () https://vuldb.com/?id.295078 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.495318 - () https://vuldb.com/?submit.495318 - Third Party Advisory, VDB Entry

11 Feb 2025, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-11 05:15

Updated : 2025-02-28 02:17

NVD link : CVE-2025-1174

Mitre link : CVE-2025-1174

CVE.ORG link : CVE-2025-1174

JSON object : View

Products Affected

1000projects

  • bookstore_management_system
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')