CVE-2026-23727
📋 TL;DR
This open redirect vulnerability in WeGIA allows attackers to redirect users to malicious external websites by manipulating the nextPage parameter. It affects all WeGIA installations prior to version 3.6.2. This can be exploited for phishing, credential theft, and malware distribution using the trusted WeGIA domain.
💻 Affected Systems
- WeGIA
📦 What is this software?
Wegia by Wegia
⚠️ Risk & Real-World Impact
Worst Case
Users are redirected to sophisticated phishing sites that steal credentials or deliver malware, leading to account compromise, data breaches, and system infections.
Likely Case
Attackers use the trusted WeGIA domain to redirect users to phishing pages for credential harvesting or social engineering attacks.
If Mitigated
Users are protected from redirection attacks, maintaining trust in the WeGIA application and preventing credential theft.
🎯 Exploit Status
Exploitation requires only URL manipulation and no authentication, making it trivial for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.2
Vendor Advisory: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-pmq9-8p4w-m4f3
Restart Required: No
Instructions:
1. Download WeGIA version 3.6.2 from the official repository. 2. Replace the existing installation with the updated files. 3. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to restrict nextPage parameter to allowed domains or relative paths only.
Modify control.php to validate nextPage parameter against a whitelist of allowed URLs.
Web Application Firewall Rule
allBlock requests containing external URLs in the nextPage parameter.
Add WAF rule to detect and block patterns like 'http://' or 'https://' in nextPage parameter.
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to restrict redirections.
- Monitor logs for suspicious redirect patterns and block malicious IP addresses.
🔍 How to Verify
Check if Vulnerable:
Test the endpoint /WeGIA/controle/control.php?metodo=listarTodos&nomeClasse=TipoSaidaControle&nextPage=http://malicious.com to see if it redirects.Check Version:
Check the WeGIA version in the application interface or configuration files.Verify Fix Applied:
After patching, test the same endpoint with external URLs; it should not redirect or should show an error.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to control.php with external URLs in nextPage parameter
- Unusual redirect patterns in access logs
Network Indicators:
- Outbound connections to suspicious domains following WeGIA access
SIEM Query:
source="web_logs" AND url="*control.php*" AND (nextPage="http://*" OR nextPage="https://*")