Vulnerability Details

In the Microweber CMS, While doing a live edit on to the application, we have the option to create a new global tag in the application. While creating a global tag, the "Tag Name" input field doesn't properly get sanitized and it's vulnerable to HTML Injection vulnerability

Steps to Reproduce

• First, Go to the shop and live edit the tag field

• You will have option to manage new tags
• In the manage tags, we can create a global tag
• While creating a global tag, In the "Tag Name" field, enter the simple HTML code like "><h2>XSS
• After saving the tag you will see a HTML tag got executed

Impact

HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.