Description

Multiple cross-site scripting (XSS) vulnerabilities exist in EJ3 BlackBook 1.0. The bookCopyright and ver parameters of footer.php, and the bookName, bookMetaTags, and estiloCSS parameters of header.php, are written into the page without HTML encoding. The include files can be requested directly, so the values are attacker controlled.

Impact

An attacker can inject JavaScript that runs in the browser of any user who opens a crafted link, which allows cookie theft, session hijacking, and page defacement.

Solution

Encode all of the affected parameters before output, and block direct requests to footer.php and header.php.

References