.. / CVE-2022-0678

• XSS
• Nuclei
• Web

Exploit for Microweber <1.2.11 - Cross-Site Scripting (CVE-2022-0678)

Description:

Packagist prior to 1.2.11 contains a cross-site scripting vulnerability via microweber/microweber. User can escape the meta tag because the user doesn’t escape the double-quote in the $redirectUrl parameter when logging out.

Nuclei Template

View the template here CVE-2022-0678.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-0678.yaml

References: