CVE-2025-22597 Overview
WeGIA is an open-source web manager for charitable institutions developed by LabRedesCefetRJ. A stored Cross-Site Scripting (XSS) vulnerability affects the CobrancaController.php endpoint in versions prior to 3.2.8. Attackers can inject malicious JavaScript through the local_recepcao parameter, which the application stores server-side without proper sanitization. The payload executes in the browser of any user who subsequently loads the affected page. The issue is tracked as [CWE-79] and resolved in WeGIA version 3.2.8.
Critical Impact
Attackers can persist arbitrary JavaScript in the WeGIA application, enabling session theft, credential harvesting, and unauthorized actions performed in the context of authenticated users.
Affected Products
- WeGIA versions prior to 3.2.8
- CobrancaController.php endpoint
- Deployments exposing the local_recepcao parameter
Discovery Timeline
- 2025-01-10 - CVE-2025-22597 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-22597
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the CobrancaController.php endpoint of WeGIA. The application accepts the local_recepcao parameter from user input and writes it to persistent storage without encoding or sanitization. When any user renders the page that displays this value, the browser interprets injected markup as executable script.
Stored XSS differs from reflected XSS because the payload persists on the server. Every visitor to the affected view triggers the injected script, expanding the attack surface beyond a single victim. Payloads can steal session cookies, perform CSRF-style requests, or pivot into administrative workflows within the WeGIA management interface.
Because WeGIA is used by charitable institutions to manage donors, beneficiaries, and financial records, successful exploitation can expose personally identifiable information and financial data handled through the platform.
Root Cause
The root cause is missing input validation and output encoding on the local_recepcao parameter. The controller neither strips nor escapes HTML metacharacters before storing the value or rendering it back to the browser, violating [CWE-79] guidance on neutralizing web page inputs.
Attack Vector
Exploitation requires an attacker to submit a crafted request to the CobrancaController.php endpoint with a JavaScript payload in the local_recepcao field. The attack is network-reachable and requires user interaction, meaning a legitimate user must load the affected page for the stored script to execute. No prior privileges are required to plant the payload if the endpoint is exposed to unauthenticated users.
The vulnerability mechanism is described in the WeGIA GitHub Security Advisory GHSA-mgj3-g922-2r9v. No public proof-of-concept exploit code is available at the time of publication.
Detection Methods for CVE-2025-22597
Indicators of Compromise
- HTTP POST requests to CobrancaController.php containing <script>, onerror=, onload=, or javascript: substrings in the local_recepcao parameter.
- Database records where the local_recepcao field contains HTML tags or encoded script fragments.
- Unexpected outbound requests from user browsers to attacker-controlled domains after visiting affected pages.
Detection Strategies
- Inspect web server and application logs for anomalous payloads submitted to the WeGIA CobrancaController.php endpoint.
- Deploy a Web Application Firewall (WAF) with signatures for common XSS payloads targeting form parameters.
- Review persisted local_recepcao values for HTML or JavaScript content that should not appear in a legitimate reception location field.
Monitoring Recommendations
- Alert on Content Security Policy (CSP) violation reports from browsers loading WeGIA pages.
- Monitor authenticated session activity for anomalous requests that could indicate cookie theft following XSS execution.
- Track WeGIA application version across deployments to identify hosts still running versions below 3.2.8.
How to Mitigate CVE-2025-22597
Immediate Actions Required
- Upgrade WeGIA to version 3.2.8 or later, which contains the vendor fix.
- Audit the database for existing local_recepcao values containing HTML or script content and sanitize or remove them.
- Restrict network exposure of WeGIA instances to trusted networks or behind authenticated VPN access where feasible.
Patch Information
The maintainers released a fix in WeGIA version 3.2.8. Details are documented in the GitHub Security Advisory GHSA-mgj3-g922-2r9v. Administrators should apply the upgrade following the project's standard deployment procedure.
Workarounds
- Deploy a WAF rule that blocks HTML tags and JavaScript event handlers in the local_recepcao parameter until patching is complete.
- Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of stored payloads.
- Restrict access to CobrancaController.php to authenticated administrative users through reverse proxy access controls.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
