CVE-2025-23033
📋 TL;DR
This stored XSS vulnerability in WeGIA allows attackers to inject malicious scripts through the 'situacao' parameter in the adicionar_situacao.php endpoint. The scripts are stored on the server and automatically execute when users access affected pages, potentially compromising user data and sessions. All WeGIA users running vulnerable versions are affected.
💻 Affected Systems
- WeGIA
📦 What is this software?
Wegia by Wegia
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator credentials, take over the WeGIA instance, access sensitive charitable donor data, and pivot to internal networks.
Likely Case
Session hijacking, credential theft, defacement of web pages, and data exfiltration from users accessing vulnerable pages.
If Mitigated
Limited impact with proper input validation and output encoding, potentially only affecting non-sensitive user data.
🎯 Exploit Status
Stored XSS vulnerabilities are commonly exploited. Requires access to the vulnerable endpoint but no authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.6
Vendor Advisory: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-r8fq-hqr2-v5j9
Restart Required: No
Instructions:
1. Backup your WeGIA instance and database. 2. Download WeGIA version 3.2.6 from the official repository. 3. Replace vulnerable files with patched version. 4. Verify the fix by testing the adicionar_situacao.php endpoint.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize the 'situacao' parameter
Modify adicionar_situacao.php to include: htmlspecialchars($_POST['situacao'], ENT_QUOTES, 'UTF-8')
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with XSS protection rules
- Disable or restrict access to the adicionar_situacao.php endpoint
🔍 How to Verify
Check if Vulnerable:
Test the adicionar_situacao.php endpoint by submitting a script payload like <script>alert('XSS')</script> in the 'situacao' parameter and check if it executes when viewing the page.Check Version:
Check WeGIA version in admin panel or review application files for version indicatorsVerify Fix Applied:
Attempt the same XSS payload test after patching; the script should be properly encoded and not execute.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to adicionar_situacao.php with script tags or JavaScript code in parameters
- Multiple failed XSS attempts
Network Indicators:
- HTTP requests containing script tags or JavaScript in POST data to the vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="*adicionar_situacao.php*" AND (body="*<script>*" OR body="*javascript:*")