CVE-2025-13650
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in Microcom's ZeusWeb application version 6.1.31. An attacker can inject malicious JavaScript into the 'Surname' field during account creation, potentially compromising user sessions or stealing credentials. Any organization using the vulnerable ZeusWeb version is affected.
💻 Affected Systems
- Microcom ZeusWeb
📦 What is this software?
Zeusweb by Microcom
⚠️ Risk & Real-World Impact
Worst Case
Attacker steals administrator credentials, takes full control of the ZeusWeb application, and potentially accesses sensitive customer data or infrastructure.
Likely Case
Attacker steals session cookies from legitimate users, hijacks their accounts, and performs unauthorized actions within the application.
If Mitigated
With proper input validation and output encoding, the attack would fail, and no user data would be compromised.
🎯 Exploit Status
The vulnerability is straightforward to exploit with basic XSS payloads. No authentication is required, making it easily weaponizable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.microcom360.com/servicio-zeus-web/
Restart Required: No
Instructions:
Contact Microcom for an official patch or upgrade instructions. Monitor their website for security updates.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation and sanitization of the 'Surname' parameter to strip or encode malicious characters.
Web Application Firewall (WAF) Rules
allDeploy a WAF with rules to block XSS payloads targeting the 'Surname' parameter.
🧯 If You Can't Patch
- Restrict access to the ZeusWeb application to trusted IP addresses only using network ACLs or firewalls.
- Disable the 'Create Account' functionality temporarily if not essential, or implement additional client-side validation as a temporary measure.
🔍 How to Verify
Check if Vulnerable:
Test by injecting a basic XSS payload (e.g., <script>alert('XSS')</script>) into the 'Surname' field during account creation and check if it executes.Check Version:
Check the application interface or configuration files for the version number, typically displayed in the web UI or footer.Verify Fix Applied:
After applying fixes, repeat the XSS test to ensure the payload is sanitized or blocked and does not execute.📡 Detection & Monitoring
Log Indicators:
- Unusual strings containing script tags or JavaScript in 'Surname' parameter logs
- Multiple failed account creation attempts with suspicious input
Network Indicators:
- HTTP POST requests to the account creation endpoint with encoded script tags in parameters
SIEM Query:
source="web_logs" AND (url="/index.html?zeus6=true" AND method="POST" AND (param="Surname" AND value CONTAINS "<script>" OR value CONTAINS "javascript:"))