CVE-2026-23729
📋 TL;DR
WeGIA versions before 3.6.2 contain an open redirect vulnerability in the control.php endpoint. Attackers can manipulate the nextPage parameter to redirect users to malicious external websites, potentially leading to phishing or malware distribution. All WeGIA instances running vulnerable versions are affected.
💻 Affected Systems
- WeGIA
📦 What is this software?
Wegia by Wegia
⚠️ Risk & Real-World Impact
Worst Case
Users redirected to convincing phishing sites that steal credentials or install malware, leading to full system compromise or data breach.
Likely Case
Phishing campaigns using the trusted WeGIA domain to trick users into visiting malicious sites or downloading malware.
If Mitigated
Users might see unexpected redirects but no direct compromise if they don't interact with malicious content.
🎯 Exploit Status
Simple parameter manipulation with no authentication required makes exploitation trivial.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.2
Vendor Advisory: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-w88p-v7h6-m728
Restart Required: No
Instructions:
1. Backup current installation. 2. Download WeGIA 3.6.2 from GitHub releases. 3. Replace vulnerable files with patched version. 4. Verify functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to restrict nextPage parameter to allowed domains only.
Modify control.php to validate nextPage against whitelist of internal URLs
URL Rewrite Rule
allBlock or sanitize malicious redirect attempts at web server level.
Add rewrite rule in .htaccess or nginx config to filter suspicious nextPage values
🧯 If You Can't Patch
- Implement WAF rules to block requests with external URLs in nextPage parameter
- Monitor logs for unusual redirect patterns and alert on suspicious activity
🔍 How to Verify
Check if Vulnerable:
Test by accessing /WeGIA/controle/control.php?metodo=listarDescricao&nomeClasse=ProdutoControle&nextPage=http://external-malicious-site.com and check if redirect occurs.Check Version:
Check WeGIA version in admin panel or read version file if available.Verify Fix Applied:
After patching, repeat the test above - should result in error or no redirect to external site.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to control.php with external URLs in nextPage parameter
- Unusual redirect patterns in access logs
Network Indicators:
- Outbound connections from WeGIA server to unexpected external domains following control.php requests
SIEM Query:
source="wegia_logs" AND uri="/WeGIA/controle/control.php" AND query="*nextPage=http*"