CVE-2025-51502: 
PHP vulnerability analysis and mitigation

CVE-2025-51502 is a Reflected Cross-Site Scripting (XSS) vulnerability in Microweber CMS affecting the layout parameter on the /admin/page/create page. It allows unauthenticated attackers to craft malicious URLs that, when visited by an authenticated admin, execute arbitrary JavaScript in the admin's browser context. The vulnerability affects Microweber versions 2.0.0 through 2.0.19 (Composer package microweber/microweber). It was discovered on May 30, 2025, and published to the GitHub Advisory Database on August 1, 2025. It carries a CVSS v3.1 base score of 6.1 (Medium) (Github Advisory, CVE Reports).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the Blade template file resources/views/page/admin/page/create.blade.php. The layout query parameter is passed directly into a dynamic @include() directive without sanitization or escaping, allowing injected HTML/JavaScript to be reflected back in the rendered admin page. An attacker crafts a URL such as /admin/page/create?layout=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E and tricks an authenticated admin into clicking it, triggering script execution. The attack requires no privileges but does require user interaction (the admin must follow the malicious link) (CVE Reports, Github Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated administrator's browser session. This can lead to theft of session cookies and CSRF tokens (the PoC demonstrates document.cookie exfiltration), unauthorized actions within the admin panel (such as content modification or account changes), DOM manipulation, and potentially further targeted attacks against the CMS administration. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component itself to the user's browser environment (CVE Reports, Github Advisory).

A public proof-of-concept exploit with detailed reproduction steps and screenshots is available on GitHub, published by the discoverer Pranav Jayan (CVE Reports). A Nuclei detection template has also been added to the ProjectDiscovery nuclei-templates repository, lowering the bar for automated scanning. There is no current evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.033–0.218% (low probability of exploitation in the next 30 days), and the vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Reconnaissance: Identify Microweber CMS instances running versions 2.0.0–2.0.19 using web fingerprinting tools (e.g., Wappalyzer, Shodan) or by checking publicly accessible admin login pages.
2. Craft malicious URL: Construct a URL targeting the vulnerable endpoint with an XSS payload in the layout parameter, e.g.:

   http://target.com/admin/page/create?layout=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

3. Social engineering: Deliver the crafted URL to an authenticated Microweber administrator via phishing email, chat message, or embedded link, inducing them to click it while logged into the admin panel.
4. Payload execution: When the admin visits the URL, the unsanitized layout parameter is reflected into the Blade template output and the injected <script> tag executes in the admin's browser context.
5. Achieve objective: The executed JavaScript can exfiltrate document.cookie (including session tokens and CSRF tokens) to an attacker-controlled server, enabling session hijacking or further unauthorized admin actions (CVE Reports).

• Network: Outbound HTTP requests from an admin browser to an external attacker-controlled domain immediately after accessing /admin/page/create; unusual GET requests to /admin/page/create with URL-encoded script tags or HTML injection characters in the layout parameter (e.g., %22%3E%3Cscript%3E, "><script>).
• Logs: Web server access logs showing requests to /admin/page/create?layout= with encoded payloads (%3Cscript%3E, %22%3E, alert, document.cookie); browser console errors related to Content Security Policy violations if CSP is configured.
• File System: No direct file system artifacts expected for reflected XSS; however, if session hijacking occurs, look for new admin sessions originating from unexpected IP addresses in application session logs.

The GitHub Advisory notes that no patched version has been formally released as of the advisory date (August 1, 2025), with affected versions listed as 2.0.0–2.0.19. Organizations should update Microweber CMS to the latest available version as soon as a patch is released. In the interim, apply the following mitigations: implement a strict Content Security Policy (CSP) header to restrict inline script execution; enforce allowlist validation on the layout parameter server-side (only permit known-safe filenames such as clean.php, home.php); restrict admin panel access to trusted IP addresses; and enable multi-factor authentication for all admin accounts (Github Advisory, CVE Reports).

A technical deep-dive blog post covering this and related Microweber CVEs was published at undercodetesting.com, highlighting the hidden dangers of CMS vulnerabilities. The ProjectDiscovery community added a Nuclei detection template for automated scanning of this vulnerability. No major vendor statements or significant mainstream media coverage have been identified beyond the initial advisory and researcher disclosure.