Reflected XSS in microweber/microweber
Apr 28th 2022
Bypass XSS filter on /module/
Proof of Concept
Drag something around to trigger the XSS. Might only work in FireFox.
How to fix
This is still CVE-2022-1439 basically.
I can break out of these html attributes, this time I use another parameter cuz I need a valid ?module= to get some html elements which I need to trigger this event handler, but the core bug is the same.
This affects many parameters on /module/ you can even define your own and they'll be appended as html attribs. You can not allow breaking out of these with quotes.
Maybe you can just replace " and ' here like < and >.
For the record here's the same bypass in the same old "module" parameter, but you have to drag somethibg else over it, e.g. a bookmark.