CVE-2025-22600 Overview
CVE-2025-22600 is a Reflected Cross-Site Scripting (XSS) vulnerability in WeGIA, an open-source web manager for charitable institutions maintained by LabRedesCefetRJ. The flaw resides in the configuracao_doacao.php endpoint, where the avulso parameter is reflected into HTTP responses without proper output encoding. Attackers can craft a malicious URL that executes arbitrary JavaScript in the victim's browser session. The issue is tracked under CWE-79 and is fixed in WeGIA version 3.2.8.
Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed in the context of authenticated WeGIA users, including administrators of charitable institution portals.
Affected Products
- WeGIA versions prior to 3.2.8
- WeGIA configuracao_doacao.php donation configuration endpoint
- Deployments exposing the avulso request parameter to untrusted input
Discovery Timeline
- 2025-01-10 - CVE-2025-22600 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-22600
Vulnerability Analysis
The vulnerability is a Reflected XSS flaw in the WeGIA donation configuration workflow. The configuracao_doacao.php script accepts the avulso HTTP parameter and returns its value inside the rendered HTML response. Because the application fails to apply context-aware output encoding, an attacker-supplied payload is interpreted by the browser as executable script. Reflected XSS requires user interaction, typically through a crafted link delivered by phishing or social engineering. Once the victim visits the link while authenticated to WeGIA, the injected JavaScript runs with the privileges of the current session.
Root Cause
The root cause is missing input validation and improper neutralization of user-controlled input during HTML page generation, categorized as [CWE-79]. The avulso parameter value is embedded directly into the response body without HTML entity encoding or a Content Security Policy (CSP) that would block inline script execution.
Attack Vector
Exploitation occurs over the network. An attacker constructs a URL containing a JavaScript payload in the avulso parameter and delivers it to a WeGIA user. When the user clicks the link, the payload executes in the browser under the WeGIA origin, exposing session cookies, CSRF tokens, and any data the authenticated user can access. In charity administration contexts, this can lead to unauthorized changes to donation configurations and disclosure of donor data.
No verified public proof-of-concept exploit code is available. See the GitHub Security Advisory GHSA-v856-wjh3-4rhg for maintainer details.
Detection Methods for CVE-2025-22600
Indicators of Compromise
- Web server access logs containing requests to configuracao_doacao.php with avulso values including <script, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E.
- Unusual outbound requests from user browsers to attacker-controlled domains shortly after visiting WeGIA URLs.
- Session anomalies such as concurrent logins or configuration changes performed from unexpected IP addresses.
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule that inspects the avulso parameter for HTML tag characters and common XSS payload patterns.
- Enable request logging with full query strings and review entries matching XSS heuristics such as <, >, on\w+=, and javascript:.
- Correlate WeGIA authentication events with subsequent administrative changes to the donation configuration to identify session abuse.
Monitoring Recommendations
- Forward WeGIA application and web server logs to a centralized SIEM for retention and rule-based alerting.
- Alert on repeated 200-status responses to configuracao_doacao.php requests carrying encoded script fragments.
- Monitor browser-reported CSP violations if a policy is enforced, since attempted XSS payloads will trigger report-uri events.
How to Mitigate CVE-2025-22600
Immediate Actions Required
- Upgrade WeGIA to version 3.2.8 or later, which contains the official fix from LabRedesCefetRJ.
- Invalidate active WeGIA sessions and force administrators to re-authenticate after patching.
- Review recent modifications to donation configurations for unauthorized changes made through hijacked sessions.
Patch Information
The maintainer released a fix in WeGIA 3.2.8. Details are published in the GitHub Security Advisory GHSA-v856-wjh3-4rhg. Administrators should pull the tagged release from the WeGIA repository and redeploy following the project's upgrade instructions.
Workarounds
- Restrict access to configuracao_doacao.php to trusted internal networks or VPN users until the patch can be applied.
- Deploy a WAF rule that rejects requests where the avulso parameter contains HTML metacharacters or script keywords.
- Enforce a strict Content Security Policy that disallows inline scripts (script-src 'self') to reduce the impact of reflected payloads.
- Set the HttpOnly and Secure flags on WeGIA session cookies to limit credential theft from injected scripts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
