CVE-2025-22613: Wegia Stored XSS Vulnerability

CVE-2025-22613 Overview

CVE-2025-22613 is a stored Cross-Site Scripting (XSS) vulnerability in WeGIA, an open source web manager targeted at Portuguese-speaking charitable institutions. The flaw resides in the informacao_adicional.php endpoint, where the descricao parameter is accepted without proper validation or output encoding. Attackers can inject malicious JavaScript that is persisted on the server and rendered whenever a user loads the affected profile page. The stored payload executes in the victim's browser context, exposing session data and enabling further account compromise. The issue is fixed in WeGIA version 3.2.6.

Critical Impact
Authenticated or unauthenticated attackers can persistently inject JavaScript into employee profile pages, executing arbitrary script in every viewer's browser and enabling session theft or targeted phishing.

Affected Products

WeGIA (LabRedesCefetRJ/WeGIA) versions prior to 3.2.6
html/funcionario/informacao_adicional.php endpoint
html/funcionario/profile_funcionario.php employee profile viewer

Discovery Timeline

2025-01-13 - CVE-2025-22613 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22613

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified under [CWE-79]. WeGIA's informacao_adicional.php accepts a descricao parameter from user input and writes it to the funcionario_listainfo database table without sanitization. When profile_funcionario.php later renders the stored values inside an HTML <option> element, it emits the raw string directly into the page. Any script tags or event handlers embedded in the stored value execute in the browser of every user viewing the affected employee profile. Because the payload persists in the database, a single injection affects all subsequent visitors until the record is removed.

Root Cause

The root cause is missing output encoding when server-side PHP renders database-sourced strings into HTML. The pre-patch code concatenated the descricao column directly into the HTML response, bypassing any escaping layer. Input validation on the write path was also absent, allowing arbitrary characters — including <, >, and quote marks — to reach persistent storage.

Attack Vector

An attacker submits a crafted descricao value containing JavaScript through the informacao_adicional.php endpoint. The malicious content is stored in the funcionario_listainfo table. When any authenticated WeGIA user loads an employee profile, the browser parses and executes the stored script, which can exfiltrate cookies, perform actions on behalf of the victim, or pivot to other application functionality.

php

// Pre-patch (vulnerable): raw database value concatenated into HTML
<?php
$descricao = $pdo->query("SELECT * FROM funcionario_listainfo;")->fetchAll(PDO::FETCH_ASSOC);
foreach ($descricao as $key => $value) {
    echo ("<option id='desc' value=" . $value["idfuncionario_listainfo"] . ">" . $value["descricao"] . "</option>");
}
?>

// Post-patch: htmlspecialchars() encodes stored values before rendering
<?php
$descricao = $pdo->query("SELECT * FROM funcionario_listainfo;")->fetchAll(PDO::FETCH_ASSOC);
foreach ($descricao as $key => $value) {
    echo ("<option id='desc' value=" . $value["idfuncionario_listainfo"] . ">" . htmlspecialchars($value["descricao"]) . "</option>");
}
?>
// Source: https://github.com/LabRedesCefetRJ/WeGIA/commit/d47412372d94dc3ca26e6416b8315895c61224fa

Detection Methods for CVE-2025-22613

Indicators of Compromise

Entries in the funcionario_listainfo table whose descricao column contains <script>, onerror=, onload=, or javascript: substrings.
Web server access logs showing POST requests to informacao_adicional.php with HTML or JavaScript characters in the descricao parameter.
Unexpected outbound requests from browsers loading profile_funcionario.php, indicating payload exfiltration.

Detection Strategies

Perform a database query against funcionario_listainfo to flag rows containing HTML tags or JavaScript event handlers in the descricao field.
Enable a Content Security Policy report-only header on WeGIA responses and monitor CSP violation reports for inline script executions on employee profile pages.
Deploy a web application firewall rule matching common XSS payload patterns on requests to /html/funcionario/informacao_adicional.php.

Monitoring Recommendations

Alert on HTTP requests to informacao_adicional.php containing angle brackets, encoded script fragments, or unusually long descricao values.
Monitor authenticated session activity for anomalous cookie access or credential submission originating from the WeGIA origin.
Review new or modified funcionario_listainfo records daily until all users are confirmed on version 3.2.6 or later.

How to Mitigate CVE-2025-22613

Immediate Actions Required

Upgrade WeGIA to version 3.2.6 or later, which applies htmlspecialchars() encoding to the vulnerable render paths.
Audit the funcionario_listainfo table and purge or sanitize any existing records containing script content.
Rotate active user sessions after patching to invalidate any tokens that may have been stolen via prior exploitation.

Patch Information

The fix is delivered in WeGIA 3.2.6 via commit d474123. The patch wraps database-sourced descricao values with htmlspecialchars() in profile_funcionario.php before rendering. Details are published in the WeGIA GitHub Security Advisory GHSA-fhpx-54ch-ccxh.

Workarounds

No official workarounds exist; upgrading to WeGIA 3.2.6 is required.
As a temporary compensating control, place WeGIA behind a WAF with XSS rulesets blocking script tags and event handler attributes on the descricao parameter.
Restrict access to informacao_adicional.php to a limited set of trusted administrators via network or authentication controls until the patch is deployed.

bash

# Upgrade WeGIA to the patched release
git fetch --tags
git checkout 3.2.6

# Identify any stored XSS payloads that must be remediated after patching
mysql -u <user> -p <database> -e "SELECT idfuncionario_listainfo, descricao FROM funcionario_listainfo WHERE descricao REGEXP '<[^>]+>|javascript:|on[a-z]+=';"