CVE-2025-22139: Wegia Wegia XSS Vulnerability

CVE-2025-22139 Overview

CVE-2025-22139 is a Reflected Cross-Site Scripting (XSS) vulnerability in WeGIA, an open-source web manager for charitable institutions. The flaw resides in the configuracao_geral.php endpoint, where the msg_c parameter reflects user-controlled input without proper sanitization or output encoding. Attackers can craft malicious URLs that execute arbitrary JavaScript in the victim's browser session when visited. The vulnerability is tracked under CWE-79 and is fixed in WeGIA version 3.2.8. Successful exploitation requires user interaction, typically through phishing or social engineering to deliver the crafted link.

Critical Impact
Attackers can hijack authenticated administrator sessions, steal cookies, or perform actions on behalf of victims within the WeGIA charitable institution management platform.

Affected Products

WeGIA (wegia:wegia) versions prior to 3.2.8
The configuracao_geral.php endpoint accepting the msg_c parameter
Deployments hosted by charitable institutions using WeGIA for administrative management

Discovery Timeline

2025-01-08 - CVE-2025-22139 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22139

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw located in the configuracao_geral.php endpoint of WeGIA. The application accepts input via the msg_c HTTP parameter and reflects that value directly into the rendered HTML response. Because the value is not encoded or sanitized before being written to the page, an attacker can inject arbitrary HTML and JavaScript payloads.

When a victim opens a maliciously crafted link, their browser interprets the injected content in the trust context of the WeGIA origin. This grants the attacker access to cookies, session tokens, and any client-side state accessible from that origin. The reflected nature of the flaw means each attack requires a fresh delivery vector such as a phishing email or malicious redirect.

Root Cause

The root cause is missing output encoding on the msg_c parameter within the general configuration page. The application echoes the parameter value into the HTML response without applying HTML entity encoding or contextual escaping, violating CWE-79 sanitization requirements.

Attack Vector

An attacker constructs a URL to configuracao_geral.php containing a JavaScript payload in the msg_c query parameter. The attacker delivers the URL to an authenticated WeGIA user through phishing, chat, or embedded links. When the target clicks the link, the payload executes in the browser and can exfiltrate session cookies, alter DOM content, or issue authenticated requests to the WeGIA backend on the user's behalf. Refer to the GitHub Security Advisory GHSA-xrjq-57mq-4hf8 for the technical description.

Detection Methods for CVE-2025-22139

Indicators of Compromise

HTTP GET or POST requests to configuracao_geral.php containing the msg_c parameter with HTML tags, <script> fragments, javascript: URIs, or event handlers such as onerror= and onload=.
URL-encoded payload signatures such as %3Cscript%3E, %3Cimg, or %22onerror%3D appearing in web server access logs targeting the WeGIA host.
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after visiting WeGIA links.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the msg_c parameter for XSS payload patterns and block requests containing script markup or JavaScript URI schemes.
Enable web server access logging with full query string capture and hunt for anomalous or encoded values on the configuracao_geral.php endpoint.
Correlate authentication events with reflected parameter anomalies to identify session hijack attempts following a click-through event.

Monitoring Recommendations

Ingest WeGIA application logs and reverse proxy logs into a centralized SIEM for retention and cross-source correlation.
Alert on outbound network connections from administrator workstations to newly observed domains during active WeGIA sessions.
Track user-agent and referrer patterns for requests to configuracao_geral.php to distinguish legitimate navigation from crafted external links.

How to Mitigate CVE-2025-22139

Immediate Actions Required

Upgrade WeGIA to version 3.2.8 or later, which contains the fix for the msg_c parameter reflection.
Invalidate active administrator and user sessions after upgrading to eliminate any tokens potentially exposed to prior exploitation.
Review web server logs for suspicious requests to configuracao_geral.php and investigate any hits containing script or event handler content.

Patch Information

The WeGIA maintainers released version 3.2.8, which sanitizes the msg_c parameter before rendering it in the response. Details and remediation guidance are published in the GitHub Security Advisory GHSA-xrjq-57mq-4hf8 and a mirror advisory at the LabRedesCefetRJ WeGIA repository. Apply the update from the official repository and verify the installed version after deployment.

Workarounds

Deploy a WAF or reverse proxy rule that strips or blocks requests where msg_c contains angle brackets, script keywords, or JavaScript URI schemes.
Enforce a strict Content-Security-Policy header on the WeGIA application to restrict inline script execution and untrusted script sources.
Set the HttpOnly and Secure flags on session cookies to reduce cookie theft impact from client-side script execution.

bash

# Example NGINX rule to block XSS-style payloads on the vulnerable parameter
location /configuracao_geral.php {
    if ($arg_msg_c ~* "(<|%3C)\s*script|javascript:|on[a-z]+\s*=") {
        return 403;
    }
    proxy_pass http://wegia_backend;
}

# Recommended response headers
add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
add_header X-Content-Type-Options "nosniff" always;