CVE-2025-51502
📋 TL;DR
This vulnerability allows attackers to inject malicious JavaScript via the layout parameter on the admin page creation interface in Microweber CMS. When exploited, it enables arbitrary code execution in the context of authenticated admin users, potentially compromising the entire CMS installation. Only Microweber CMS 2.0 installations with admin access are affected.
💻 Affected Systems
- Microweber CMS
📦 What is this software?
Microweber by Microweber
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full administrative control over the CMS, can deface websites, steal sensitive data, install backdoors, or pivot to other systems in the network.
Likely Case
Attacker hijacks admin sessions to modify content, steal credentials, or perform limited administrative actions within the CMS.
If Mitigated
With proper input validation and output encoding, the attack is prevented, though the vulnerable parameter remains accessible.
🎯 Exploit Status
Exploitation requires admin authentication but is straightforward once access is obtained. Proof of concept is available in public repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.1 or later
Vendor Advisory: https://github.com/microweber/microweber/security/advisories
Restart Required: No
Instructions:
1. Backup your Microweber installation. 2. Update to Microweber CMS version 2.0.1 or later via the admin panel or manual download. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize the layout parameter before processing.
Modify the relevant PHP file to include: $layout = htmlspecialchars($_GET['layout'], ENT_QUOTES, 'UTF-8');
Web Application Firewall Rule
allBlock malicious requests containing script tags in the layout parameter.
Add WAF rule: Block requests where layout parameter contains <script> or javascript: patterns
🧯 If You Can't Patch
- Restrict admin panel access to trusted IP addresses only using .htaccess or firewall rules.
- Implement Content Security Policy (CSP) headers to prevent inline script execution.
🔍 How to Verify
Check if Vulnerable:
Access /admin/page/create?layout=<script>alert('XSS')</script> as admin and check if script executes.Check Version:
Check admin panel dashboard or view version.php file in installation root.Verify Fix Applied:
After patching, test the same payload; it should be properly encoded and not execute.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /admin/page/create with suspicious layout parameter values containing script tags or encoded payloads
Network Indicators:
- Unusual POST/GET requests to admin endpoints with JavaScript in parameters
SIEM Query:
source="web_logs" AND uri_path="/admin/page/create" AND (layout="*<script>*" OR layout="*javascript:*")