CVE-2024-33299

Stored Cross Site Scripting vulnerability in Microweber <= 2.0.9

Summary :

A Stored Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users

Requirements :

• Microweber version <= 2.0.9
• Admin access

Steps to reproduce :

1. Authenticate the application with administrative privileges
2. Go to the endpoint /admin/users
3. Select any user to edit (or create one later edit)
4. Insert the payload <img src=x onerror=alert(1)> on either "First Name" or "Last Name" as both fields can trigger the JavaScript injection
5. Go to the endpoint /admin/module/view?type=users to trigger the JavaScript injection

Affected components :

• /admin/module/view?type=users

Impact :

An attacker could execute JavaScript code in the victim's browser, obtaining information or forcing the user to access malicious websites, for example.

Relevant References

https://www.cve.org/CVERecord?id=CVE-2024-33299