CVE-2025-22599
📋 TL;DR
A reflected cross-site scripting (XSS) vulnerability exists in WeGIA's home.php endpoint via the msg_c parameter. Attackers can inject malicious scripts that execute in victims' browsers when they visit crafted URLs. This affects all WeGIA users running vulnerable versions.
💻 Affected Systems
- WeGIA
📦 What is this software?
Wegia by Wegia
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal session cookies, perform account takeover, redirect users to malicious sites, or deploy malware through victim browsers.
Likely Case
Session hijacking leading to unauthorized access to charitable institution data and administrative functions.
If Mitigated
Limited impact with proper input validation, output encoding, and Content Security Policy (CSP) headers.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link). Advisory includes proof-of-concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.8
Vendor Advisory: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-8354-6cxw-7g8c
Restart Required: No
Instructions:
1. Backup current installation. 2. Download WeGIA version 3.2.8 from official repository. 3. Replace vulnerable files with patched version. 4. Verify functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize msg_c parameter before processing.
Modify home.php to include: $msg_c = htmlspecialchars($_GET['msg_c'], ENT_QUOTES, 'UTF-8');
Web Application Firewall (WAF)
allDeploy WAF rules to block XSS payloads in URL parameters.
Add WAF rule: Detect and block patterns like <script>, javascript:, and onload= in URL parameters.
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to block inline script execution.
- Deploy network segmentation to isolate WeGIA from sensitive systems.
🔍 How to Verify
Check if Vulnerable:
Test by accessing: http://[wegia-url]/home.php?msg_c=<script>alert('XSS')</script> and checking if script executes.Check Version:
Check WeGIA version in admin panel or review application files for version identifier.Verify Fix Applied:
After patching, repeat vulnerability test; script should not execute and input should be properly encoded.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to home.php with suspicious parameters containing script tags or JavaScript code.
- Unusual length or character patterns in msg_c parameter values.
Network Indicators:
- Outbound connections to unknown domains following visits to crafted WeGIA URLs.
- Increased traffic to home.php endpoint with varied parameter values.
SIEM Query:
source="web_logs" AND url="*home.php*" AND (msg_c="*<script>*" OR msg_c="*javascript:*" OR msg_c="*onload=*")