BookMine is the complete, multi-user, Windows-based, Inventory management system designed for Booksellers and Book Distributors.

SQLi occurs where the "events_id" variable doesn't properly sanitize input submitted to the events.cfm script.
This may allow an attacker to inject or manipulate SQL queries in the backend database.

Cross-site scripting occurs where the "gallery" and "search_string" variables don't properly sanitize input submitted to the search.cfm script. Additionally, the "events_id" doesn't properly sanitize input submitted to the events.cfm script.
This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

References:

CVE-2008-3393 , 3394

BID: 30432

OSVDB: 47202 , 47203

SA: 31258

XF: 44067

Vendor Solution: pending