Description
Multiple cross-site scripting (XSS) vulnerabilities exist in EJ3 BlackBook 1.0. The bookCopyright and ver parameters of footer.php, and the bookName, bookMetaTags, and estiloCSS parameters of header.php, are written into the page without HTML encoding. The include files can be requested directly, so the values are attacker controlled.
Impact
An attacker can inject JavaScript that runs in the browser of any user who opens a crafted link, which allows cookie theft, session hijacking, and page defacement.
Solution
Encode all of the affected parameters before output, and block direct requests to footer.php and header.php.