Description

The endpoint https://demo.microweber.org/demo/admin/post/{id}/edit is vulnerable to cross site scripting.
The “Edit source” field is affected.

Proof of Concept

1. Login into https://demo.microweber.org
2. Navigate to https://demo.microweber.org/demo/admin/post/25/edit
3. click EditSource, and put this payload:

<img src>

4. and click Ok
5. The xss payload will be executed.

Impact

Cross site scripting attacks can lead to account takeover via cookie stealing, temporary webpage deface, redirections etc.