CVE-2026-1444: Books_Manager XSS Vulnerability

CVE-2026-1444 Overview

A stored Cross-Site Scripting (XSS) vulnerability has been identified in iJason-Liu Books_Manager, affecting the file controllers/books_center/add_book_check.php. The vulnerability exists due to improper sanitization of the mark parameter, allowing attackers to inject malicious scripts that execute in the context of other users' browsers. This vulnerability can be exploited remotely by authenticated users with elevated privileges.

Critical Impact

Attackers can inject persistent malicious scripts through the mark parameter, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of legitimate users.

Affected Products

• iJason-Liu Books_Manager up to commit 298ba736387ca37810466349af13a0fdf828e99c

Discovery Timeline

• 2026-01-26 - CVE-2026-1444 published to NVD
• 2026-01-27 - Last updated in NVD database

Technical Details for CVE-2026-1444

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw resides in the add_book_check.php controller file within the Books_Manager application. When processing book entries, the application fails to properly sanitize or encode user-supplied input in the mark parameter before storing it in the database and subsequently rendering it in web pages.

Because this is a stored XSS vulnerability, the malicious payload persists in the application's data store and executes whenever other users view the affected content. The attack requires network access and some level of user interaction for the payload to trigger in a victim's browser session.

Root Cause

The root cause of this vulnerability is the absence of proper input validation and output encoding for the mark argument in the add_book_check.php file. The application accepts user input and stores it without sanitization, then renders it directly in HTML output without encoding special characters. This allows HTML and JavaScript injection that persists across sessions.

Attack Vector

The attack can be launched remotely over the network. An attacker with privileged access to the application can submit a crafted value for the mark parameter containing malicious JavaScript code. When this data is retrieved and displayed to other users, the script executes in their browser context, potentially allowing the attacker to steal session cookies, redirect users to malicious sites, or perform actions on behalf of the victim.

The vulnerability mechanism involves the following flow:

1. An authenticated attacker with elevated privileges accesses the book addition functionality
2. The attacker submits a request to add_book_check.php with a malicious payload in the mark parameter
3. The unsanitized input is stored in the application's database
4. When other users view the affected book entry, the stored payload executes in their browser

For detailed technical analysis, see the Y1Fan Blog Post on XSS and VulDB #342873.

Detection Methods for CVE-2026-1444

Indicators of Compromise

• Unexpected JavaScript code or HTML tags present in the mark field of book database entries
• User reports of suspicious browser behavior or redirects when viewing book entries
• Audit logs showing unusual input patterns containing script tags or event handlers in the mark parameter
• Network traffic containing encoded JavaScript payloads targeting the add_book_check.php endpoint

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS payloads in request parameters
• Monitor HTTP request logs for suspicious patterns in the mark parameter, including <script>, javascript:, and event handler attributes
• Deploy Content Security Policy (CSP) headers to detect and report inline script execution attempts
• Review database entries periodically for stored script content in user-controllable fields

Monitoring Recommendations

• Enable verbose logging on the web server for all requests to controllers/books_center/add_book_check.php
• Configure alerting for CSP violation reports indicating attempted inline script execution
• Implement database integrity monitoring to detect unexpected HTML/JavaScript content in book records
• Set up user behavior analytics to identify unusual session activities that may indicate XSS exploitation

How to Mitigate CVE-2026-1444

Immediate Actions Required

• Implement input validation on the mark parameter to reject or sanitize potentially malicious content
• Apply output encoding (HTML entity encoding) when rendering the mark field in web pages
• Review and sanitize existing database entries for any previously injected malicious content
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS attacks

Patch Information

This product does not use versioning, which makes tracking specific patch releases challenging. Users should monitor the iJason-Liu Books_Manager repository for commits that address input sanitization in the add_book_check.php file. The vulnerable code exists up to commit 298ba736387ca37810466349af13a0fdf828e99c.

Workarounds

• Restrict access to the book addition functionality to only trusted administrators until a patch is available
• Deploy a Web Application Firewall (WAF) with XSS detection rules to filter malicious input
• Implement server-side input validation using an allowlist approach for the mark parameter
• Add HTTP-only and Secure flags to session cookies to reduce the impact of potential cookie theft

# Example Apache configuration to add security headers
<IfModule mod_headers.c>
    # Content Security Policy to mitigate XSS
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
    
    # X-XSS-Protection for older browsers
    Header set X-XSS-Protection "1; mode=block"
    
    # X-Content-Type-Options to prevent MIME sniffing
    Header set X-Content-Type-Options "nosniff"
</IfModule>