CVE-2025-70792: 
PHP vulnerability analysis and mitigation

CVE-2025-70792 is a reflected Cross-Site Scripting (XSS) vulnerability in the /admin/category/create endpoint of Microweber, an open-source CMS. Affecting version 2.0.19, the flaw allows an unauthenticated attacker to craft a malicious URL that, when visited by an admin user, executes arbitrary JavaScript in their browser. The vulnerability was reported to developers and fixed in version 2.0.20, with public disclosure on February 5, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (Github Advisory, Feedly).

The root cause is improper neutralization of user-supplied input (CWE-79): the rel_id GET parameter passed to userfiles/modules/categories/edit_category.php was directly assigned to a PHP variable and reflected into the HTML response without sanitization. The fix applied in commit aa0791f wraps the parameter with the xss_clean() function before use ($data['rel_id'] = xss_clean($_GET['rel_id']);). The same commit also addressed similar unsanitized GET parameters in several other admin modules (e.g., layout, option_group, show_inner). A public proof-of-concept demonstrates exploitation via a URL-encoded <script>alert(1);</script> payload injected into the rel_id parameter (PoC Gist, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of an authenticated admin user, operating within the admin's session context. This can lead to session hijacking, credential theft, unauthorized account creation, defacement of website content, or further actions performed on behalf of the compromised administrator. Confidentiality and integrity impacts are low and scoped to the browser session; there is no direct availability impact (Github Advisory, Feedly).

A public proof-of-concept exploit is available as a GitHub Gist published by researcher TimRecktenwald on February 4, 2026, demonstrating a working alert payload via a crafted URL (PoC Gist). There is no evidence of active in-the-wild exploitation at this time, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.036%, indicating a low near-term exploitation probability (Github Advisory).

1. Reconnaissance: Identify Microweber installations running version 2.0.19 using web search, Shodan, or Censys queries targeting Microweber-specific HTTP response headers or page content.
2. Craft malicious URL: Construct a URL targeting the vulnerable endpoint with a JavaScript payload injected into the rel_id parameter, URL-encoding the payload. Example:

   http://target.com/admin/category/create?category_subtype=default&data_type=category&id=0&is_hidden=1&parent=blog&parent_id=0&rel_id=%22%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&rel_type=content

3. Social engineering: Deliver the crafted URL to a user with admin privileges via phishing email, chat message, or other social engineering vector, enticing them to click the link.
4. JavaScript execution: When the admin visits the URL, the injected <script> tag is reflected into the page HTML and executed in their browser within the admin session context.
5. Post-exploitation: Replace the alert(1) payload with a more sophisticated script to steal session cookies, exfiltrate CSRF tokens, create rogue admin accounts, or perform actions on the CMS on behalf of the victim (PoC Gist).

• Network: HTTP GET requests to /admin/category/create containing URL-encoded script tags or HTML injection sequences in the rel_id parameter (e.g., %3Cscript%3E, %22%3E, javascript:).
• Logs: Web server access logs showing requests to /admin/category/create with anomalous or encoded values in the rel_id query parameter from external or unexpected IP addresses.
• Logs: Admin activity logs showing unusual actions (account creation, content modification, settings changes) shortly after an admin user accessed a suspicious URL.
• Browser/Session: Unexpected session invalidation or new admin accounts appearing in the CMS without legitimate administrative action.

The primary remediation is to upgrade Microweber from version 2.0.19 to version 2.0.20 or later, which applies xss_clean() sanitization to the rel_id parameter and several other previously unsanitized GET parameters (Patch Commit, Github Advisory). As interim mitigations, restrict access to the admin panel to trusted IP ranges, implement a Content Security Policy (CSP) header to limit script execution, and train administrators to avoid clicking unsolicited or suspicious links. Input validation and output encoding at the application layer should be enforced as a defense-in-depth measure.