Description

It is possible to execute XSS payloads when editing book properties, such as uploading a cover or a format.

Proof of Concept

The file edit_books.js contains the following code:

$("#btn-upload-cover").on("change", function () {
    var filename = $(this).val();
    if (filename.substring(3, 11) === "fakepath") {
        filename = filename.substring(12);
    } 
    $("#upload-cover").html(filename); # this is the vulnerable code.
});

XSS PoC (video)

Impact

This allows stoling cookies, for example. But the variety of attacks can increase depending on the payload.