Description

The Microweber application allows HTML tags in the “First name”, “Last name” and “Phone number” which can be exploited by Injecting HTML payloads.

Proof of Concept

1.While buying product we need to fill contact information form.

2.Insert your html code in code block. e.g., <code><p>Hurry Up!<a href>Go to https://evil.com and get free $1000 in your account now .</a></p></code> (any field except mail)

3.Click on Continue, then your code will be injected into the Personal information section which can be viewed on ‘domain/shipping-method’ page.

Image & Video POC

https://drive.google.com/drive/folders/1hVdfSQrknQNHOudKPK0ZvqsXkqQxxdtW?usp=sharing

Impact

This vulnerability can be exploit for phishing attack