Microweber CMS vulnerabilities

In Microweber CMS version 0.95 before 20141209, there is an SQL injection vulnerability in Category.php that allows remote attackers to execute arbitrary SQL commands via the category parameter.

Microweber CMS up to version 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system. An authenticated attacker can inject arbitrary JavaScript via the tag_names parameter of the GET /api/save_content_admin endpoint, bypassing three independent sanitization controls. The injected script executes without user interaction for every visitor to the public blog page and within the admin post editor.

Microweber CMS through version 2.0.20 contains a server-side template injection vulnerability. Authenticated administrators can achieve arbitrary OS command execution by injecting Twig expressions into mail templates.

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller. Unauthenticated attackers can read arbitrary files by supplying directory traversal sequences in the path query parameter.

Microweber CMS versions <= 1.2.11 contain an authenticated local file inclusion vulnerability through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the filesystem by specifying an absolute path in the src parameter, leading to local file disclosure.