Microweber Cross-Site Scripting Vulnerability in Abandoned Orders Endpoint

A cross-site scripting (XSS) vulnerability has been identified in Microweber version 2.0.19, specifically within the '/admin/order/abandoned' endpoint. The issue arises from the 'orderDirection' parameter, which can be manipulated in a crafted URL. An attacker could lure an admin user to visit this URL, resulting in the execution of JavaScript code in the user's browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can execute malicious scripts in the context of the victim's browser.

Reproduction

To reproduce this vulnerability, first install Microweber version 2.0.19. After setting up the application, navigate to the '/admin/order/abandoned' endpoint and include a crafted 'orderDirection' parameter that contains JavaScript code, such as a script tag with an alert function. When the page is loaded, the JavaScript will execute, demonstrating the cross-site scripting vulnerability.

Remediation

Users can upgrade to Microweber version 2.0.20 or later, where this vulnerability has been fixed.