Online Book Shop Using PHP has Cross-Site Scripting (XSS) vulnerability via $catnm paremeter in /subcat.php.
https://code-projects.org/online-book-shop-using-php-source-code/
/subcat.php - $catnm paremeter.
In the /subcat.php file, an unrestricted Cross-Site Scripting (XSS) vulnerability and injection attacks exist, specifically targeting the $catnm paremeter. The function echo the user-supplied parameter without validation. Malicious attackers can leverage this vulnerability to access sensitive client information.
Path: /subcat.php?cat_nm=1&cat=1&catnm=<img/src/onerror=alert(1)>
<div id="page">
<!-- start content -->
<div id="content">
<div class="post">
<h1 class="title"><?php echo $_GET['catnm'];?></h1>
<div class="entry">