CVE-2025-22599: Wegia Wegia Reflected XSS Vulnerability

CVE-2025-22599 Overview

CVE-2025-22599 is a Reflected Cross-Site Scripting (XSS) vulnerability in WeGIA, an open-source web manager for charitable institutions maintained by LabRedesCefetRJ. The flaw resides in the home.php endpoint, where the msg_c parameter reflects user-supplied input into the response without proper sanitization or output encoding. Attackers can craft malicious URLs that execute arbitrary JavaScript in the context of a victim's browser session. The issue is classified under CWE-79 and has been fixed in WeGIA version 3.2.8.

Critical Impact
Attackers can execute arbitrary JavaScript in victim browsers, enabling session hijacking, credential theft, and unauthorized actions against the WeGIA administrative interface.

Affected Products

WeGIA versions prior to 3.2.8
Vendor: LabRedesCefetRJ (wegia:wegia)
Affected component: home.php endpoint, msg_c parameter

Discovery Timeline

2025-01-10 - CVE-2025-22599 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22599

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the WeGIA application's home.php endpoint. The msg_c query parameter accepts arbitrary input and reflects it into the rendered HTML response without contextual output encoding or input validation. When a victim clicks a crafted link, the payload executes within the trusted origin of the WeGIA deployment.

Because WeGIA is used by charitable institutions to manage donor records, financial transactions, and personal beneficiary data, script execution in an administrator's session grants access to sensitive organizational information. Attackers can exfiltrate session cookies, perform authenticated actions on behalf of the user, or pivot to further compromise the hosting environment.

Root Cause

The root cause is missing output encoding of the msg_c parameter before it is embedded into the HTML response generated by home.php. The application trusts the query string value and writes it directly into the page context, allowing HTML and JavaScript payloads to break out of the intended data context.

Attack Vector

Exploitation requires user interaction. An attacker delivers a crafted URL containing a JavaScript payload in the msg_c parameter through phishing, chat platforms, or malicious referrers. When an authenticated WeGIA user visits the link, the payload executes in the browser under the application's origin. No authentication is required from the attacker to construct the URL, and the reflected payload runs with the privileges of the victim's active session.

Refer to the GitHub Security Advisory GHSA-8354-6cxw-7g8c for advisory details. No public proof-of-concept exploit code is currently published.

Detection Methods for CVE-2025-22599

Indicators of Compromise

HTTP GET requests to home.php containing suspicious characters in the msg_c parameter such as <script>, onerror=, javascript:, or URL-encoded equivalents like %3Cscript%3E.
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after visits to home.php.
Web server access logs showing referrers from external phishing domains directing users to home.php?msg_c=....

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the msg_c parameter for HTML tags, event handlers, and script keywords.
Enable server-side request logging and alert on query string values exceeding expected length or containing angle brackets.
Correlate authenticated session activity with abnormal browser-generated requests to detect post-exploitation session abuse.

Monitoring Recommendations

Monitor WeGIA application logs for anomalous msg_c values and repeated 200-OK responses to crafted payloads.
Track user-agent and IP patterns tied to reflected XSS delivery attempts across email and messaging gateways.
Review Content Security Policy (CSP) violation reports if CSP is enabled, as blocked inline scripts often indicate exploitation attempts.

How to Mitigate CVE-2025-22599

Immediate Actions Required

Upgrade WeGIA to version 3.2.8 or later, which contains the official fix for CVE-2025-22599.
Invalidate active administrative sessions and rotate credentials for any accounts that may have been targeted by phishing.
Audit web server access logs for prior exploitation attempts targeting the msg_c parameter of home.php.

Patch Information

The maintainers released the fix in WeGIA 3.2.8. Details are documented in the GitHub Security Advisory GHSA-8354-6cxw-7g8c. Administrators should pull the patched release from the official WeGIA repository and validate deployment through functional testing.

Workarounds

Deploy a WAF rule to block requests where the msg_c parameter contains <, >, or script tokens until the patch is applied.
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Restrict access to the WeGIA management interface via IP allowlists or VPN to reduce phishing exposure.

bash

# Example WAF/ModSecurity rule to block XSS payloads in msg_c
SecRule ARGS:msg_c "@rx (?i)(<script|onerror=|javascript:|<img|onload=)" \
    "id:1002259,phase:2,deny,status:403,\
    msg:'CVE-2025-22599 WeGIA Reflected XSS attempt in msg_c parameter'"