CVE-2025-22598 Overview
CVE-2025-22598 is a Stored Cross-Site Scripting (XSS) vulnerability in WeGIA, an open-source web manager used by charitable institutions. The flaw resides in the cadastrarSocio.php endpoint, where the local_recepcao parameter fails to sanitize user-supplied input. Attackers can inject malicious JavaScript that persists on the server and executes in the browser of any user who loads the affected page. The vulnerability is tracked under [CWE-79] and affects WeGIA versions prior to 3.2.8. The maintainers, LabRedesCefetRJ, released a fix in version 3.2.8.
Critical Impact
Attackers can execute arbitrary JavaScript in victim browsers, enabling session theft, credential harvesting, and unauthorized actions within the WeGIA application.
Affected Products
- WeGIA versions prior to 3.2.8
- Component: wegia:wegia
- Vulnerable endpoint: cadastrarSocio.php
Discovery Timeline
- 2025-01-10 - CVE-2025-22598 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-22598
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the WeGIA charitable institution management application. The cadastrarSocio.php endpoint accepts the local_recepcao parameter without applying output encoding or input sanitization. Any HTML or JavaScript submitted through this parameter is persisted to the database. When a legitimate user later renders the affected page, the stored payload executes in their browser context.
Because the payload persists server-side, exploitation does not require repeated attacker interaction. The attack targets any authenticated user or administrator who accesses the rendered record. Successful exploitation permits session cookie theft, forced actions via forged requests, and staged phishing content injected into a trusted application surface.
Root Cause
The root cause is missing output encoding on the local_recepcao field. WeGIA renders the stored parameter directly into HTML without escaping characters such as <, >, and ". This is a classic [CWE-79] Improper Neutralization of Input During Web Page Generation flaw.
Attack Vector
The attack vector is network-based and requires user interaction — a victim must load the page that renders the poisoned record. An attacker submits a crafted payload to the local_recepcao parameter through the affected form. The payload is stored server-side and delivered to every subsequent viewer of the record. Privileges are not required to submit input where the application exposes registration functionality to unauthenticated users.
Refer to the GitHub Security Advisory GHSA-9x2j-pw3h-p53f for the vendor's technical description.
Detection Methods for CVE-2025-22598
Indicators of Compromise
- HTTP POST requests to cadastrarSocio.php containing <script>, onerror=, onload=, or encoded JavaScript within the local_recepcao parameter.
- Database records in WeGIA member tables where the local_recepcao column contains HTML tags or JavaScript event handlers.
- Outbound requests from user browsers to unexpected domains immediately after loading WeGIA member records.
Detection Strategies
- Inspect web server access logs for anomalous payloads submitted to cadastrarSocio.php, focusing on angle brackets and JavaScript keywords in form fields.
- Deploy a Web Application Firewall (WAF) rule that flags XSS signatures targeting WeGIA endpoints.
- Run periodic queries against the WeGIA database to identify member records containing script tags or HTML in text fields that should hold plain strings.
Monitoring Recommendations
- Enable Content Security Policy (CSP) violation reporting to capture inline script execution attempts within the WeGIA application.
- Monitor authenticated session activity for unusual navigation patterns following visits to member records.
- Alert on new administrative actions initiated shortly after a user loads records containing the local_recepcao field.
How to Mitigate CVE-2025-22598
Immediate Actions Required
- Upgrade WeGIA to version 3.2.8 or later, which contains the vendor patch for CVE-2025-22598.
- Audit existing member records for stored payloads in the local_recepcao field and purge any malicious content before restoring service.
- Rotate active session tokens for all users after remediation to invalidate any sessions that may have been hijacked.
Patch Information
The vendor released the fix in WeGIA version 3.2.8. Consult the WeGIA GitHub Security Advisory for release notes and upgrade guidance. Deploy the update from the official LabRedesCefetRJ/WeGIA repository.
Workarounds
- Restrict access to cadastrarSocio.php through network controls or authentication until the upgrade is applied.
- Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of stored XSS payloads.
- Apply server-side input validation via a reverse proxy or WAF that strips HTML tags from the local_recepcao parameter until patching is complete.
# Example WAF rule concept (ModSecurity) blocking script tags in local_recepcao
SecRule ARGS:local_recepcao "@rx (?i)(<script|onerror=|onload=|javascript:)" \
"id:1002259,phase:2,deny,status:403,msg:'WeGIA CVE-2025-22598 XSS attempt blocked'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
