CVE-2025-23037
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in WeGIA's control.php endpoint allows attackers to inject malicious scripts via the cargo parameter. These scripts are stored on the server and automatically execute when users access the affected page, potentially compromising user data and systems. All WeGIA users running vulnerable versions are affected.
💻 Affected Systems
- WeGIA
📦 What is this software?
Wegia by Wegia
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal session cookies, credentials, and sensitive data from all users accessing the vulnerable page, potentially leading to full account takeover and data exfiltration.
Likely Case
Attackers inject malicious scripts that steal user session cookies or credentials, compromising individual user accounts and potentially spreading to other parts of the application.
If Mitigated
With proper input validation and output encoding, malicious scripts are neutralized before execution, preventing any exploitation.
🎯 Exploit Status
Stored XSS vulnerabilities are commonly exploited, though specific exploit details for this CVE are not publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.6
Vendor Advisory: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-rjjp-w2wm-7f9j
Restart Required: Yes
Instructions:
1. Backup your current WeGIA installation and database. 2. Download WeGIA version 3.2.6 from the official repository. 3. Replace the vulnerable files with the patched version. 4. Restart the web server service. 5. Verify the fix by testing the control.php endpoint.
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with XSS protection rules to block malicious payloads.
- Disable or restrict access to the control.php endpoint if it's not essential for your operations.
🔍 How to Verify
Check if Vulnerable:
Check if your WeGIA version is below 3.2.6 by examining the application version in the admin panel or configuration files.Check Version:
Check the WeGIA configuration files or admin interface for version information.Verify Fix Applied:
After upgrading to version 3.2.6, test the control.php endpoint with XSS payloads to ensure they are properly sanitized and do not execute.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to control.php with script tags or JavaScript in the cargo parameter
- Multiple failed XSS attempts in web server logs
Network Indicators:
- HTTP requests containing script tags or JavaScript payloads in the cargo parameter
SIEM Query:
source="web_server_logs" AND uri="/control.php" AND (cargo CONTAINS "<script>" OR cargo CONTAINS "javascript:")