CVE-2025-1174— 1000 Projects Bookstore Management System Add Book Page process_book_add.php cross site scripting
Quick assessment
Affected
1000 Projects Bookstore Management System
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
1000 Projects Bookstore Management System是1000 Projects开源的一个书店管理系统。 1000 Projects Bookstore Management System 1.0版本存在代码注入漏洞，该漏洞源于文件process_book_add.php的参数Book Name会导致跨站脚本攻击。
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1071 · Application Layer Protocol T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-1174
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
1000 Projects Bookstore Management System Add Book Page process_book_add.php cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in 1000 Projects Bookstore Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file process_book_add.php of the component Add Book Page. The manipulation of the argument Book Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
1000 Projects Bookstore Management System 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
1000 Projects Bookstore Management System是1000 Projects开源的一个书店管理系统。 1000 Projects Bookstore Management System 1.0版本存在代码注入漏洞，该漏洞源于文件process_book_add.php的参数Book Name会导致跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| 1000 Projects | Bookstore Management System | 1.0 | - |
|
II. Public POCs for CVE-2025-1174
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-1174
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-1174 (3)
-
CVE-2025-1174 1000 Projects Bookstore Management System Add Book Page process_book_add.php cross site scripting signature permissions-required
-
Submit #495318: 1000 Projects Bookstore Management System 1.0 Cross Site Scripting third-party-advisory
-
CVE-2025-1174 1000 Projects Bookstore Management System Add Book Page process_book_add.php cross site scripting vdb-entry technical-description
Proof of Concept for CVE-2025-1174 (1)
-
1000 Projects Bookstore Management System XSS_Stored · Issue #3 · NeoVuln/CVE exploit issue-tracking
Other References for CVE-2025-1174 (1)
Same Patch Batch · 1000 Projects · 2025-02-11 · 3 CVEs total
| CVE-2025-1172 | 6.3 MEDIUM | 1000 Projects Bookstore Management System addtocart.php sql injection |
| CVE-2025-1173 | 4.7 MEDIUM | 1000 Projects Bookstore Management System process_users_del.php sql injection |
IV. Related Vulnerabilities
Same product: Bookstore Management System
-
CVE-2025-10833
1000projects Bookstore Management System login.php sql injec -
CVE-2025-1173
1000 Projects Bookstore Management System process_users_del. -
CVE-2025-1172
1000 Projects Bookstore Management System addtocart.php sql -
CVE-2024-13002
1000 Projects Bookstore Management System order_process.php -
CVE-2024-11673
1000 Projects Bookstore Management System cross-site request
Same vendor: 1000 Projects
-
CVE-2026-7144
1000 Projects Portfolio Management System MCA update_passwd_ -
CVE-2026-7143
1000 Projects Portfolio Management System MCA block_status.p -
CVE-2025-8936
1000 Projects Sales Management System dordupdate.php sql inj -
CVE-2025-8935
1000 Projects Sales Management System custcmp.php sql inject -
CVE-2025-8934
1000 Projects Sales Management System sales.php cross site s
Same weakness: CWE-79
-
CVE-2026-66610
WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) v -
CVE-2026-32476
WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cr -
CVE-2026-28166
WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting -
CVE-2026-28162
WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scri -
CVE-2026-78290
WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scrip
V. Comments for CVE-2025-1174
No comments yet