Administration Panel
Monthly
Arbitrary file upload in Microweber Administration Panel allows an authenticated high-privileged administrator to upload unrestricted files, including executable server-side scripts, resulting in remote code execution and complete system compromise. The vulnerable upload forms are administrative features and require prior administrator-level access, so exploitation is not unauthenticated. There is no public exploit identified at time of analysis; the reported EICAR test-file demonstration underscores the missing validation but is not equivalent to active exploitation.
Reflected cross-site scripting in the Microweber administration panel lets an attacker inject JavaScript through the 'group' parameter of the /admin/settings endpoint, which executes in the browser of an administrator who opens a crafted URL. Exploitation is constrained: the attacker must first trick a logged-in administrator (PR:H) into clicking a malicious link (UI:A), and there is no impact on the server itself - any damage is confined to the victim's browser session, where session hijacking or unauthorized actions in the admin context become possible. An independent assessment rates this as a moderate, low-priority issue, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary file upload in Microweber Administration Panel allows an authenticated high-privileged administrator to upload unrestricted files, including executable server-side scripts, resulting in remote code execution and complete system compromise. The vulnerable upload forms are administrative features and require prior administrator-level access, so exploitation is not unauthenticated. There is no public exploit identified at time of analysis; the reported EICAR test-file demonstration underscores the missing validation but is not equivalent to active exploitation.
Reflected cross-site scripting in the Microweber administration panel lets an attacker inject JavaScript through the 'group' parameter of the /admin/settings endpoint, which executes in the browser of an administrator who opens a crafted URL. Exploitation is constrained: the attacker must first trick a logged-in administrator (PR:H) into clicking a malicious link (UI:A), and there is no impact on the server itself - any damage is confined to the victim's browser session, where session hijacking or unauthorized actions in the admin context become possible. An independent assessment rates this as a moderate, low-priority issue, and no public exploit code or confirmed active exploitation was identified at time of analysis.