Steps

1.Visit https://demo.microweber.org

2.Click option 'Modules' in the left list

3.Click and go into the 'Button'

4.Click the 'edit url' and Enter the following

><script>alert(1)

Proof of Concept Video

https://1drv.ms/v/s!Ai0UEGpMIb9scRgdvmX1sBCQu4A

Impact

1. Phishing, including obtaining various user accounts

2. Steal the user's cookies to obtain the user's privacy information, or use the user's identity to further operate the website;

3. Hijacking user (browser) sessions to perform arbitrary operations, such as illegal transfer, forced posting of logs, e-mail, etc

4. Forced pop up of advertising pages, traffic, etc

5. Web hanging horse;

6. Conduct malicious operations, such as arbitrarily tampering with page information, deleting articles, etc

7. Carry out a large number of client attacks, such as ddos

8. Obtain client information, such as user's browsing history, real p, open port, etc

9. Control the victim's machine to attack other websites;

10. Implement progress hazards in combination with other vulnerabilities, such as csrf;

11. Improve user rights, including further penetration of the website

12. Propagating cross site scripting worms, etc