CVE-2018-19917

Vulnerability

Microweber 1.0.8 is vulnerable to reflected cross-site scripting (XSS) as reported in advisory NS-18-038 [1],[4]. The flaw exists because user-supplied input in URL parameters is not adequately sanitized before being reflected back to the browser, enabling injection of arbitrary HTML and JavaScript code. No authentication or special configuration is required; an attacker only needs to trick a victim into visiting a crafted link [4].

Exploitation

An attacker crafts a malicious URL containing a script payload in the query string, e.g., /?s=. When the victim clicks the link, the browser executes the injected script in the context of the Microweber application [1],[4]. No user interaction beyond clicking the link is required; the attacker does not need to be authenticated or have any special privileges [4].

Impact

Successfully exploiting the vulnerability allows the attacker to execute arbitrary JavaScript in the victim's browser session. This can lead to session cookie theft, page content manipulation, or redirection to malicious sites within the trust context of the legitimate Microweber site [1],[4]. The impact is limited to information disclosure and UI spoofing; no direct server compromise is achieved through this XSS alone.

Mitigation

As of the disclosure date (January 2019), no official patch had been released for Microweber 1.0.8 [4]. The vendor was notified but the vulnerability remained unfixed. Users should upgrade to a later version if available, or apply strict input validation and output encoding as a temporary workaround. The CVE is not listed on the CISA KEV, and no fix is confirmed in available references [4].