CVE-2025-22139
📋 TL;DR
A reflected cross-site scripting (XSS) vulnerability exists in WeGIA's configuracao_geral.php endpoint via the msg_c parameter. Attackers can inject malicious scripts that execute in victims' browsers when they visit crafted URLs. This affects all WeGIA users running vulnerable versions.
💻 Affected Systems
- WeGIA
📦 What is this software?
Wegia by Wegia
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal session cookies, perform account takeover, redirect users to malicious sites, or perform actions on behalf of authenticated users.
Likely Case
Session hijacking, credential theft, or defacement of the application interface through injected scripts.
If Mitigated
Limited impact if input validation and output encoding are properly implemented, though some script execution may still occur.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious link) but is straightforward via URL parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.8
Vendor Advisory: https://github.com/nilsonLazarin/WeGIA/security/advisories/GHSA-xrjq-57mq-4hf8
Restart Required: No
Instructions:
1. Backup current installation. 2. Download version 3.2.8 from official repository. 3. Replace vulnerable files with patched versions. 4. Verify functionality.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rule
allBlock malicious script patterns in the msg_c parameter
Input Validation Filter
allImplement server-side validation to sanitize msg_c parameter
🧯 If You Can't Patch
- Restrict access to configuracao_geral.php endpoint using network ACLs or authentication
- Implement Content Security Policy (CSP) headers to mitigate script execution
🔍 How to Verify
Check if Vulnerable:
Test by accessing configuracao_geral.php?msg_c=<script>alert('XSS')</script> and checking if script executesCheck Version:
Check WeGIA version in admin interface or read version file if availableVerify Fix Applied:
After patching, repeat the test; script should not execute and input should be properly encoded📡 Detection & Monitoring
Log Indicators:
- Unusual length or script patterns in msg_c parameter in access logs
- Multiple failed attempts with script payloads
Network Indicators:
- HTTP requests containing script tags in msg_c parameter
- Unusual redirects from WeGIA application
SIEM Query:
source="web_logs" AND uri="*configuracao_geral.php*" AND (msg_c="*script*" OR msg_c="*javascript:*")