CVE-2025-51501: 
PHP vulnerability analysis and mitigation

CVE-2025-51501 is a Reflected Cross-Site Scripting (XSS) vulnerability in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS. It affects versions 2.0.0 through 2.0.19 (composer package microweber/microweber). The vulnerability was discovered on May 30, 2025, reported to the developer the same day, and publicly disclosed on August 1, 2025. It carries a CVSS v3.1 base score of 6.1 (Medium) (Github Advisory, CVE Reports).

The root cause is improper neutralization of user-supplied input (CWE-79) in the id query parameter of the /api/live_edit/live_edit.module_settings endpoint, which reflects unsanitized input directly into the HTTP response without escaping. An attacker crafts a malicious URL containing a JavaScript payload (e.g., <script>alert(document.cookie)</script>) in the id parameter and tricks an authenticated admin user into visiting it, causing the script to execute in the victim's browser session. The attack requires no authentication from the attacker but does require user interaction — specifically, an authenticated admin must follow the crafted link. A public PoC demonstrating cookie theft via alert(document.cookie) is available (CVE Reports).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated Microweber CMS admin session, enabling session cookie theft, credential harvesting, CSRF token bypass, and unauthorized actions performed on behalf of the admin user. The changed scope (S:C) in the CVSS rating reflects that the injected script can affect resources beyond the vulnerable component itself, such as the admin's browser environment. There is no direct availability impact, but integrity and confidentiality of the admin session and CMS content are at risk (Github Advisory, CVE Reports).

1. Reconnaissance: Identify Microweber CMS instances running versions 2.0.0–2.0.19 using web fingerprinting tools (e.g., Wappalyzer, Shodan, or Nuclei with the available template).
2. Craft malicious URL: Construct a URL targeting the vulnerable endpoint with a JavaScript payload in the id parameter, e.g.:

   https://target.example.com/api/live_edit/live_edit.module_settings?id=<script></script><script>alert(document.cookie)</script>&type=shop/shipping/gateways/country/admin

   URL-encoded form of the payload: %3Cscript%3E%3C/script%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
3. Deliver the payload: Send the crafted URL to an authenticated Microweber admin via phishing email, chat message, or embedded link, inducing them to click it while logged into the admin panel.
4. Achieve JavaScript execution: When the admin visits the URL, the unsanitized id value is reflected in the response and the injected script executes in their browser session, exposing session cookies or performing actions as the admin.
5. Escalate: Use the stolen session cookie to hijack the admin session, perform unauthorized CMS modifications, or pivot to further attacks (CVE Reports).

• Network: HTTP GET requests to /api/live_edit/live_edit.module_settings containing <script>, URL-encoded script tags (%3Cscript%3E), or alert( in the id query parameter; unexpected outbound connections from admin browsers to attacker-controlled domains following such requests.
• Logs: Web server access logs showing requests to /api/live_edit/live_edit.module_settings?id= with encoded or raw XSS payloads; repeated access to this endpoint from unusual referrers or external sources.
• File System: No direct file system artifacts expected for reflected XSS, but review for any unauthorized CMS content changes or new admin accounts created following a potential exploitation event.
• Process/Session: Unexpected admin session activity (e.g., logins from new IPs, content modifications) shortly after suspicious requests to the vulnerable endpoint (CVE Reports).

The GitHub Advisory notes that no patched version has been officially released as of the advisory date (August 1, 2025), with affected versions listed as >= 2.0.0, <= 2.0.19. Administrators should monitor the Microweber project for an updated release and apply it promptly. In the interim, implement a Web Application Firewall (WAF) rule to block requests containing script tags or encoded XSS payloads in the id parameter of the live_edit.module_settings endpoint, apply strict Content Security Policy (CSP) headers, and restrict access to the admin API endpoints to trusted IP ranges where possible (Github Advisory, CVE Reports).

The vulnerability was reported by researcher Pranav Jayan and published to the GitHub Advisory Database on August 1, 2025. A technical write-up covering this and related Microweber CVEs was published by Undercode Testing, highlighting the risks of unsanitized input in CMS admin panels. Nuclei templates for automated detection were contributed to the ProjectDiscovery community repository, reflecting practitioner interest in scanning for this class of vulnerability (CVE Reports, Github Advisory).