Vulnerability: Cross-site Scripting in Microweber Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18.
Vulnerability ID: GHSA-3x96-m42v-hvh5
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/microweber/microweber
Published: 2022-06-23
File: userfiles/modules/microweber/toolbar/editor_tools/module_settings/index.php
Commit message: update
Commit author: Peter Ivanov

Vulnerable version (before fix):
     if (isset($_GET['autosize'])) {         $autoSize = $_GET['autosize'];     }      $type = '';     if (isset($_GET['type'])) {         $type = $_GET['type'];     }      $mod_id = $mod_orig_id = false;     $is_linked_mod = false;                 if (mw.notification) {                     mw.notification.success('<?php _ejs('Settings are saved') ?>');                 }                 mw.reload_module_parent('#<?php print $params['id']  ?>')              });  <body class="mw-external-loading loading"> <div id="settings-main">     <div id="settings-container">         <div class="mw-module-live-edit-settings <?php print $params['id'] ?>"              id="module-id-<?php print $params['id'] ?>">{content}         </div>     </div> </div> 

Fixed version (after fix):
     if (isset($_GET['autosize'])) {         $autoSize = $_GET['autosize'];     }     $autoSize = xss_clean($autoSize);      $type = '';     if (isset($_GET['type'])) {         $type = $_GET['type'];     }     $type = xss_clean($type);      $mod_id = $mod_orig_id = false;     $is_linked_mod = false;                 if (mw.notification) {                     mw.notification.success('<?php _ejs('Settings are saved') ?>');                 }                 <?php if (isset($params['id'])) : ?>                 mw.reload_module_parent('#<?php print $params['id']  ?>')                 <?php endif; ?>              });  <body class="mw-external-loading loading"> <div id="settings-main">     <div id="settings-container">         <?php if (isset($params['id'])) : ?>             <div class="mw-module-live-edit-settings <?php print $params['id'] ?>"                  id="module-id-<?php print $params['id'] ?>">{content}             </div>         <?php endif; ?>     </div> </div> 

Patch:
patch: @@ -87,11 +87,13 @@
     if (isset($_GET['autosize'])) {
         $autoSize = $_GET['autosize'];
     }
+    $autoSize = xss_clean($autoSize);
 
     $type = '';
     if (isset($_GET['type'])) {
         $type = $_GET['type'];
     }
+    $type = xss_clean($type);
 
     $mod_id = $mod_orig_id = false;
     $is_linked_mod = false;
@@ -403,7 +405,9 @@
                 if (mw.notification) {
                     mw.notification.success('<?php _ejs('Settings are saved') ?>');
                 }
+                <?php if (isset($params['id'])) : ?>
                 mw.reload_module_parent('#<?php print $params['id']  ?>')
+                <?php endif; ?>
 
             });
 
@@ -440,9 +444,11 @@
 <body class="mw-external-loading loading">
 <div id="settings-main">
     <div id="settings-container">
-        <div class="mw-module-live-edit-settings <?php print $params['id'] ?>"
-             id="module-id-<?php print $params['id'] ?>">{content}
-        </div>
+        <?php if (isset($params['id'])) : ?>
+            <div class="mw-module-live-edit-settings <?php print $params['id'] ?>"
+                 id="module-id-<?php print $params['id'] ?>">{content}
+            </div>
+        <?php endif; ?>
     </div>
 </div>
path: userfiles/modules/microweber/toolbar/editor_tools/module_settings/index.php