A critical code injection vulnerability in Microweber CMS allows authenticated attackers with administrative privileges to achieve full system compromise.

The application is susceptible to server-side template injection (CWE-94) within its mail template functionality. This flaw requires the attacker to have administrative privileges to successfully trigger the injection.

The exploitation of this vulnerability grants an attacker the ability to execute arbitrary code on the underlying server, leading to a total loss of confidentiality, integrity, and availability. Given the CVSS score of 7.2, this represents a significant risk to organizational infrastructure, as attackers could pivot to internal networks or exfiltrate sensitive data stored within the CMS environment.

Immediate Action: Update Microweber CMS to a version beyond 2.0.20 as soon as the vendor provides a patch.

Proactive Monitoring: Monitor server logs for suspicious mail template modifications or unauthorized execution of system commands initiated by the web server process.

Compensating Controls: Restrict administrative access to the CMS to trusted internal IP addresses and employ a Web Application Firewall (WAF) to inspect and block malicious injection patterns in template inputs.

Public Exploit Available: Unknown.

Organizations utilizing Microweber CMS must prioritize this vulnerability due to the high severity of code injection. Security teams should audit administrative accounts to ensure only authorized personnel have access, as these credentials are the primary vector for this exploit. Apply the vendor update immediately upon release to remediate the underlying flaw.