Books4Cash
Monthly
Reflected cross-site scripting (CWE-79) in the abandoned open-source PHP application Books4Cash allows unauthenticated remote attackers to inject arbitrary script into the search page by crafting a malicious 'Search' argument accepted by search.php. The payload is returned to the browser without sanitization, so the impact is confined to the victim's session - an attacker can execute script in the context of the site, deface or alter content, and potentially capture session data or perform actions as the victim. Exploitation is not unattended: a victim must follow an attacker-supplied link (CVSS UI:P social-engineering prerequisite), and publicly available exploit code exists per the CVSS 4.0 E:P metric and VulDB disclosure. Real-world exposure is limited because the project repository has been dormant for years and has a negligible deployment footprint; no CISA KEV entry indicates active exploitation.
Reflected cross-site scripting (CWE-79) in the abandoned open-source PHP application Books4Cash allows unauthenticated remote attackers to inject arbitrary script into the search page by crafting a malicious 'Search' argument accepted by search.php. The payload is returned to the browser without sanitization, so the impact is confined to the victim's session - an attacker can execute script in the context of the site, deface or alter content, and potentially capture session data or perform actions as the victim. Exploitation is not unattended: a victim must follow an attacker-supplied link (CVSS UI:P social-engineering prerequisite), and publicly available exploit code exists per the CVSS 4.0 E:P metric and VulDB disclosure. Real-world exposure is limited because the project repository has been dormant for years and has a negligible deployment footprint; no CISA KEV entry indicates active exploitation.