Improper Handling of Length Parameter Inconsistency in microweber/microweber


Reported on

Feb 17th 2022


There is no input field length in update username where any user can able to add large number of characters like imagine we can add more 5000+ character on to the update name field .

Steps to Reproduce

  • Visit the particular URL Vulnerable-link
  • Where there is a functionality to update our own profile
  • In the name field , Enter the following payload now update the profile
  • As you can see without any length validation , our payload got updated on to the profile

Impact of this Vulnerability:

An attacker would make use of this vulnerability and this leads to

  • Memory corruption
  • Denial of Service


Remediation: We can fix this by implementing a character limit where any user or admin can enter only 255 characters and not more than 255 character on the input field


We are processing your report and will contact the microweber team within 24 hours. 3 months ago
3 months ago



Peter Ivanov validated this vulnerability 3 months ago
Nithissh12 has been awarded the disclosure bounty
The fix bounty is now up for grabs
Peter Ivanov confirmed that a fix has been merged on 62333f 3 months ago
Peter Ivanov has been awarded the fix bounty
my_profile_admin.php#L1-L81 has been validated
3 months ago


There isn't a CVE assigned for this case ?

3 months ago



Jamie Slome
3 months ago


I have responded to your e-mail.

to join this conversation