CVE-2024-41381: 
PHP vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in microweber version 2.0.16. The vulnerability exists in the userfiles\modules\settings\admin.php file and was disclosed on July 17, 2024 (GitHub Issue, NVD).

The vulnerability stems from insufficient input validation in the admin.php file where the 'group' parameter from GET requests is not properly sanitized before being used. The vulnerability path flows from line 15 (source) where $_GET['group'] is assigned to $show_group variable, to line 100 (sink) where it's used without proper filtering (GitHub Issue). The CVSS v3.1 base score is 6.1 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) according to CISA-ADP assessment (NVD).

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. This could potentially lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected user's session (NVD).

The vulnerability can be exploited by sending a specially crafted HTTP GET request to the affected endpoint. A proof of concept exists showing exploitation via the URL path '/admin/module/view?type=settings&group=1"></module><script>alert('xss')</script><module>"' (GitHub Issue).