Improper Handling of Length Parameter Inconsistency in microweber/microweber


Reported on

Feb 17th 2022


There is no input field length in update username where any user can able to add large number of characters like imagine we can add more 5000+ character on to the update name field .

Steps to Reproduce

  • Visit the particular URL Vulnerable-link
  • Where there is a functionality to update our own profile
  • In the name field , Enter the following payload now update the profile
  • As you can see without any length validation , our payload got updated on to the profile

Impact of this Vulnerability:

An attacker would make use of this vulnerability and this leads to

  • Memory corruption
  • Denial of Service


Remediation: We can fix this by implementing a character limit where any user or admin can enter only 255 characters and not more than 255 character on the input field


We are processing your report and will contact the microweber team within 24 hours. 2 years ago
2 years ago



Peter Ivanov validated this vulnerability 2 years ago
nithissh200 has been awarded the disclosure bounty
The fix bounty is now up for grabs
Peter Ivanov marked this as fixed in 1.2.11 with commit 62333f 2 years ago
Peter Ivanov has been awarded the fix bounty
my_profile_admin.php#L1-L81 has been validated
2 years ago


There isn't a CVE assigned for this case ?

2 years ago



Jamie Slome
2 years ago

I have responded to your e-mail.

to join this conversation