CVE-2025-57763
📋 TL;DR
WeGIA versions before 3.4.7 contain a reflected cross-site scripting vulnerability in the insere_despacho.php endpoint that allows attackers to inject malicious scripts via the cpf parameter. This affects all users of vulnerable WeGIA installations, potentially allowing session hijacking, credential theft, or defacement. The vulnerability is fixed in version 3.4.7.
💻 Affected Systems
- WeGIA
📦 What is this software?
Wegia by Wegia
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, hijack user sessions, redirect users to malicious sites, or deface the application interface.
Likely Case
Attackers could steal session cookies or perform limited client-side attacks against users who click malicious links.
If Mitigated
With proper input validation and output encoding, the impact is minimal as scripts would be properly sanitized.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link) and knowledge of the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.7
Vendor Advisory: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-67w3-jf96-f754
Restart Required: No
Instructions:
1. Backup current installation. 2. Download WeGIA 3.4.7 from official repository. 3. Replace vulnerable files with patched version. 4. Verify installation works correctly.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation for the cpf parameter in insere_despacho.php
Add input sanitization for cpf parameter before processing
WAF Rule
allDeploy web application firewall rules to block XSS payloads in the cpf parameter
Configure WAF to detect and block script tags and JavaScript in cpf parameter
🧯 If You Can't Patch
- Restrict access to insere_despacho.php endpoint using firewall rules or access controls
- Implement Content Security Policy headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Test the insere_despacho.php endpoint with XSS payloads in the cpf parameter and check if scripts executeCheck Version:
Check WeGIA version in application interface or configuration filesVerify Fix Applied:
Test the same XSS payloads after patching to confirm they are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual requests to insere_despacho.php with script tags or JavaScript in parameters
- Multiple failed XSS attempts in web logs
Network Indicators:
- HTTP requests containing script tags or JavaScript in cpf parameter
- Unusual traffic patterns to the vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="*insere_despacho.php*" AND (param="*<script>*" OR param="*javascript:*")