CVE-2025-57765
📋 TL;DR
A reflected cross-site scripting (XSS) vulnerability in WeGIA's pre_cadastro_adotante.php endpoint allows attackers to inject malicious scripts via the msg_e parameter. This affects all WeGIA installations prior to version 3.4.7, potentially compromising user sessions and data. Charitable institutions using vulnerable versions are at risk.
💻 Affected Systems
- WeGIA
📦 What is this software?
Wegia by Wegia
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, perform actions on behalf of authenticated users, or deface the application.
Likely Case
Session hijacking leading to unauthorized access to sensitive donor/adoptee information and potential data theft.
If Mitigated
Limited impact with proper input validation and output encoding, though some risk remains if user input is reflected without sanitization.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious link) and knowledge of the vulnerable parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.7
Vendor Advisory: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-39r5-c63f-99mx
Restart Required: No
Instructions:
1. Backup current installation. 2. Download WeGIA 3.4.7 from official repository. 3. Replace vulnerable files with patched version. 4. Verify fix by testing the msg_e parameter.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize the msg_e parameter
Add input sanitization in pre_cadastro_adotante.php: $msg_e = htmlspecialchars($_GET['msg_e'], ENT_QUOTES, 'UTF-8');
🧯 If You Can't Patch
- Implement WAF rules to block XSS payloads in the msg_e parameter
- Disable or restrict access to the pre_cadastro_adotante.php endpoint if not required
🔍 How to Verify
Check if Vulnerable:
Test the pre_cadastro_adotante.php endpoint with payload: ?msg_e=<script>alert('XSS')</script>Check Version:
Check WeGIA version in admin panel or read version file if availableVerify Fix Applied:
Test the same payload after patching - script should be encoded and not execute📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing script tags or JavaScript in msg_e parameter
- Unusual length or encoding in msg_e parameter values
Network Indicators:
- HTTP GET requests to pre_cadastro_adotante.php with suspicious msg_e values
SIEM Query:
source="web_logs" AND uri="*pre_cadastro_adotante.php*" AND (msg_e="*<script>*" OR msg_e="*javascript:*")