Insecure Storage of Sensitive Information in microweber/microweber


Reported on

Feb 19th 2022


When the user uploads his profile picture, the uploaded image’s EXIF Geolocation Data does not get stripped. As a result, anyone can get sensitive information of microweber users like their Geolocation, their Device information like Device Name, Version, Software & Software version used, etc.

Proof of Concept:-

1.Browse this link:-

2.Download the image Upload the picture on your profile and click on save.

3.Now see the path of the uploaded image ( Either by right click on image then copy image address OR right-click, inspect the image, the URL will come in the inspect, edit it as HTML )

4.Then open:-

5.Paste the URL ( of the profile image path now you can see the EXIF data.

Image PoC:-


This vulnerability impacts all users on microweber. This vulnerability violates the privacy of a User and shares sensitive information of the user who uploads their profile picture on microweber.

We are processing your report and will contact the microweber team within 24 hours. 2 years ago
SAMPRIT DAS modified the report
2 years ago
SAMPRIT DAS modified the report
2 years ago
We have contacted a member of the microweber team and are waiting to hear back 2 years ago
Bozhidar Slaveykov validated this vulnerability 2 years ago
SAMPRIT DAS has been awarded the disclosure bounty
The fix bounty is now up for grabs
Bozhidar Slaveykov marked this as fixed in 1.3 with commit b592c8 2 years ago
Bozhidar Slaveykov has been awarded the fix bounty
This vulnerability will not receive a CVE
2 years ago


here is a new picture uploaded with no data info about it

2 years ago


Hello @bobimicroweber,

I have confirmed that the vulnerability has been fixed and I want to know when are the Description and References going to be updated on ?

Regards, @sampritdas8

to join this conversation