Listen to this Post
How the CVE Works
The vulnerability exists in Microweber CMS versions 2.0.0 to 2.0.19 due to insufficient input sanitization in user profile fields. Attackers can inject malicious JavaScript payloads into editable profile fields (e.g., name, bio). When an admin views the compromised profile, the script executes in their browser, potentially leading to session hijacking, data theft, or privilege escalation. The attack persists due to improper output encoding when rendering user-supplied data.
DailyCVE Form
Platform: Microweber CMS
Version: 2.0.0-2.0.19
Vulnerability: Stored XSS
Severity: Low
Date: Aug 2, 2025
Prediction: Patch by Sep 2025
What Undercode Say
Check installed version microweber --version Exploit PoC (sanitized) curl -X POST -d 'name=<script>alert(1)</script>' /api/profile/update Mitigation (temporary) sed -i 's/<script>//g' /var/www/html/modules/user/profile.php
How Exploit
1. Attacker injects `` into profile.
2. Admin views profile, triggering script execution.
3. Attacker steals session cookies.
Protection from this CVE
- Apply vendor patch (pending).
- Sanitize user inputs with
htmlspecialchars(). - Implement CSP headers.
Impact
- Admin account compromise.
- Data exfiltration.
- Reputation damage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
