Microweber Cross-Site Scripting Vulnerability in Settings Handler

A reflected cross-site scripting vulnerability has been identified in Microweber version 2.0.19. This issue resides in the Settings Handler component, specifically within the 'userfiles/modules/settings/group/website_group/index.php' file. The vulnerability is triggered by manipulating the 'group' parameter, which allows for the injection of malicious scripts that are executed in the context of other users' browsers.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Reproduction

To reproduce this vulnerability, send a request to the 'userfiles/modules/settings/group/website_group/index.php' file with a crafted 'group' parameter that includes the malicious script. The injected script will be executed as an alert, demonstrating the cross-site scripting vulnerability.