CVE-2025-62598
📋 TL;DR
This reflected cross-site scripting (XSS) vulnerability in WeGIA allows attackers to inject malicious scripts via the action parameter in the editar_info_pessoal.php endpoint. When exploited, this can lead to session hijacking, credential theft, or redirection to malicious sites. All WeGIA installations prior to version 3.5.1 are affected.
💻 Affected Systems
- WeGIA
📦 What is this software?
Wegia by Wegia
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, hijack user sessions, redirect users to phishing sites, or perform actions on behalf of authenticated users.
Likely Case
Attackers craft malicious links containing JavaScript payloads that execute when victims click them, potentially stealing session cookies or credentials.
If Mitigated
With proper input validation and output encoding, malicious scripts would be neutralized before execution.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious link) and knowledge of the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.1
Vendor Advisory: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jmm7-rr7w-f223
Restart Required: No
Instructions:
1. Download WeGIA version 3.5.1 from the official repository. 2. Replace the vulnerable editar_info_pessoal.php file with the patched version. 3. Verify the fix by testing the endpoint with XSS payloads.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to sanitize the action parameter before processing.
Web Application Firewall (WAF)
allDeploy a WAF with XSS protection rules to block malicious requests to the vulnerable endpoint.
🧯 If You Can't Patch
- Restrict access to the /WeGIA/html/pessoa/editar_info_pessoal.php endpoint using network ACLs or authentication.
- Implement Content Security Policy (CSP) headers to mitigate the impact of successful XSS attacks.
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with a simple XSS payload: /WeGIA/html/pessoa/editar_info_pessoal.php?action=<script>alert('XSS')</script>Check Version:
Check the WeGIA version in the application interface or configuration files.Verify Fix Applied:
After patching, test the same payload; it should not execute JavaScript and should be properly sanitized.📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /WeGIA/html/pessoa/editar_info_pessoal.php with suspicious parameters containing script tags or JavaScript code.
Network Indicators:
- Unusual traffic patterns to the vulnerable endpoint, especially with encoded or obfuscated payloads.
SIEM Query:
source="web_server" AND uri="/WeGIA/html/pessoa/editar_info_pessoal.php" AND (param="action" AND value CONTAINS "script" OR "javascript")