CVE-2025-0295: Online Book Shop XSS Vulnerability

CVE-2025-0295 Overview

CVE-2025-0295 is a reflected cross-site scripting (XSS) vulnerability in code-projects Online Book Shop 1.0. The flaw resides in the /booklist.php endpoint, where the subcatnm parameter is reflected into the response without proper output encoding. Attackers can craft a URL containing malicious JavaScript and trick authenticated users into visiting it, causing script execution in the victim's browser context. The exploit has been publicly disclosed, which lowers the barrier for opportunistic abuse. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser session, enabling session data theft, UI redress, and phishing against authenticated users of the Online Book Shop application.

Affected Products

code-projects Online Book Shop 1.0
Deployments exposing /booklist.php?subcatid=1 with the subcatnm parameter
Any downstream forks reusing the vulnerable booklist.php handler

Discovery Timeline

2025-01-07 - CVE-2025-0295 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0295

Vulnerability Analysis

The vulnerability is a classic reflected XSS. The booklist.php script accepts the subcatnm query parameter and echoes its value into the rendered HTML without sanitization or contextual encoding. Because the application returns the attacker-controlled string inside the page body, a browser interprets injected <script> tags or event handlers as executable code.

Exploitation requires low privileges and no user interaction beyond following an attacker-crafted link. The attack originates over the network against the web front-end. The confidentiality and availability impacts are none, but integrity is affected because the attacker can rewrite page content and perform actions on behalf of the visiting user.

See the VulDB record and the public proof-of-concept gist for technical details.

Root Cause

The root cause is missing input validation and missing output encoding on the subcatnm GET parameter within booklist.php. The application concatenates untrusted input directly into HTML output, violating standard [CWE-79] guidance to context-encode data before rendering.

Attack Vector

An attacker constructs a URL such as /booklist.php?subcatid=1&subcatnm=<payload> where <payload> contains JavaScript. When a victim opens the link, the server reflects the payload into the response and the browser executes it. Delivery typically occurs through phishing emails, forum posts, or malicious redirects.

No authenticated exploit code is required beyond the crafted URL. The public proof of concept demonstrates payload delivery through the subcatnm parameter.

Detection Methods for CVE-2025-0295

Indicators of Compromise

Web server access logs showing requests to /booklist.php with subcatnm values containing <script, onerror=, javascript:, or URL-encoded equivalents such as %3Cscript.
HTTP referrers originating from untrusted domains immediately followed by outbound requests from user browsers to attacker-controlled hosts.
Unexpected Set-Cookie header extractions or session identifiers appearing in outbound traffic from client browsers.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the subcatnm parameter for HTML metacharacters and known XSS payload signatures.
Enable dynamic application security testing (DAST) against staging deployments to confirm reflected input in booklist.php responses.
Correlate reflected parameter values with response bodies in logging pipelines to flag echoed script content.

Monitoring Recommendations

Aggregate PHP application logs and reverse proxy logs into a central analytics platform and alert on anomalous query strings targeting booklist.php.
Monitor Content Security Policy (CSP) violation reports for inline script executions on /booklist.php.
Track outbound requests from user browsers to newly registered domains following visits to the Online Book Shop application.

How to Mitigate CVE-2025-0295

Immediate Actions Required

Restrict public exposure of the Online Book Shop 1.0 instance behind authentication or IP allow-lists until a fix is applied.
Apply a WAF rule blocking HTML control characters (<, >, ", ') and common XSS payload keywords in the subcatnm parameter.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources.

Patch Information

No vendor patch has been published in the referenced advisories at the time of writing. Consult the code-projects resource hub for future updates. Operators should modify booklist.php to validate subcatnm against an allow-list and apply HTML entity encoding (for example, htmlspecialchars($subcatnm, ENT_QUOTES, 'UTF-8')) before rendering.

Workarounds

Add server-side input validation that rejects any subcatnm value containing non-alphanumeric characters.
Apply output encoding using htmlspecialchars or an equivalent context-aware encoder on every reflected parameter in booklist.php.
Deploy CSP headers with default-src 'self' and script-src 'self' to block execution of injected inline scripts.

bash

# Example Apache mod_security rule to block XSS payloads in subcatnm
SecRule ARGS:subcatnm "@rx (?i)(<script|onerror=|javascript:|onload=)" \
  "id:1002950,phase:2,deny,status:403,log,msg:'CVE-2025-0295 XSS attempt on booklist.php'"