CVE-2025-22596: Wegia Wegia XSS Vulnerability

CVE-2025-22596 Overview

CVE-2025-22596 is a Reflected Cross-Site Scripting (XSS) vulnerability in WeGIA, an open-source web manager used by charitable institutions. The flaw resides in the modulos_visiveis.php endpoint, where the msg_c parameter fails to properly sanitize user-supplied input before reflecting it into the HTTP response. Attackers can craft malicious URLs that inject JavaScript into a victim's browser session. The vulnerability is tracked under [CWE-79] and is fixed in WeGIA version 3.2.8.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of an authenticated WeGIA user, enabling session hijacking, credential theft, and unauthorized actions within the charitable institution's management portal.

Affected Products

WeGIA versions prior to 3.2.8
modulos_visiveis.php endpoint
Deployments maintained by LabRedesCefetRJ

Discovery Timeline

2025-01-10 - CVE-2025-22596 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22596

Vulnerability Analysis

The vulnerability is a Reflected XSS flaw located in the modulos_visiveis.php endpoint of the WeGIA application. The endpoint accepts a msg_c query parameter and echoes its value back into the rendered HTML without applying output encoding or input filtering. An attacker who crafts a URL containing JavaScript payloads in msg_c can trigger script execution when a victim clicks the link.

Because the payload runs within the origin of the WeGIA application, it inherits the victim's session context. This exposes session cookies, CSRF tokens, and any privileged actions the victim can perform. WeGIA is used by charitable institutions to manage donor, beneficiary, and financial records, increasing the sensitivity of exposed data.

Root Cause

The root cause is missing input validation and output encoding on the msg_c parameter processed by modulos_visiveis.php. User-controlled data is inserted into the HTML response context without HTML entity encoding, allowing <script> tags and event handler attributes to be parsed by the browser.

Attack Vector

Exploitation requires user interaction. An attacker delivers a crafted URL through phishing email, chat, or a malicious website. When an authenticated WeGIA user follows the link, the injected script executes in their browser. The attack is network-reachable, requires no privileges, and can be automated at scale against known WeGIA deployments.

The vulnerability is described in prose because no verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-jcj3-gqj3-rrvm for vendor technical details.

Detection Methods for CVE-2025-22596

Indicators of Compromise

HTTP requests to modulos_visiveis.php containing msg_c parameter values with <script>, onerror=, onload=, or javascript: substrings.
Web server access logs showing URL-encoded payloads such as %3Cscript%3E or %3Cimg in the msg_c query string.
Unexpected outbound requests from user browsers to attacker-controlled domains immediately after visiting WeGIA URLs.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the msg_c parameter for HTML tags and JavaScript event handlers.
Enable request logging on the WeGIA web server and alert on parameter values exceeding expected length or containing angle brackets.
Correlate authenticated session anomalies, such as unexpected API calls, with prior visits to modulos_visiveis.php containing suspicious query strings.

Monitoring Recommendations

Aggregate web server and application logs into a centralized logging platform for pattern analysis.
Monitor Content Security Policy (CSP) violation reports if CSP is deployed on the WeGIA host.
Track authentication events and administrative actions performed shortly after XSS-suspect URL access.

How to Mitigate CVE-2025-22596

Immediate Actions Required

Upgrade WeGIA to version 3.2.8 or later, which contains the vendor fix for the msg_c parameter.
Audit web server logs for prior requests to modulos_visiveis.php containing script-like payloads and investigate any matching sessions.
Force session invalidation and password resets for privileged accounts if suspicious activity is identified.

Patch Information

The vendor released a fix in WeGIA 3.2.8. Details are published in the GitHub Security Advisory GHSA-jcj3-gqj3-rrvm maintained by LabRedesCefetRJ. Administrators should pull the latest release from the official repository and follow the standard upgrade procedure for their deployment.

Workarounds

Restrict access to modulos_visiveis.php at the reverse proxy or WAF layer until the upgrade is applied.
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources.
Configure the HttpOnly and Secure flags on session cookies to reduce impact of session token theft via XSS.

bash

# Example nginx WAF rule to block script payloads in msg_c
location /html/modulos_visiveis.php {
    if ($arg_msg_c ~* "(<|%3C)\s*script|onerror=|onload=|javascript:") {
        return 403;
    }
    proxy_pass http://wegia_backend;
}