Description

Bypass XSS filter on /module/

Proof of Concept

https://demo.microweber.org/demo/module/?module=admin%2Fmodules%2Fmanage&id=x"draggable="true"ondragexit=alert(1)&class=x&from_url=x

Drag something around to trigger the XSS.
Might only work in FireFox.

How to fix

This is still CVE-2022-1439 basically.
I can break out of these html attributes, this time I use another parameter cuz I need a valid ?module= to get some html elements which I need to trigger this event handler, but the core bug is the same.

This affects many parameters on /module/ you can even define your own and they’ll be appended as html attribs.
You can not allow breaking out of these with quotes.

Maybe you can just replace " and ’ here like < and >.