CVE-2025-22616: Wegia Wegia Stored XSS Vulnerability

CVE-2025-22616 Overview

CVE-2025-22616 is a Stored Cross-Site Scripting (XSS) vulnerability in WeGIA, an open source web manager targeting Portuguese-speaking charitable institutions. The flaw resides in the dependente_parentesco_adicionar.php endpoint, where the descricao parameter is written to the database without proper validation or sanitization. When any user later loads the affected page, the injected payload executes in the victim's browser. The issue is tracked as [CWE-79] and has been fixed in WeGIA version 3.2.6.

Critical Impact
Attackers can persist arbitrary JavaScript in the WeGIA database and hijack sessions, steal data, or perform actions on behalf of authenticated users viewing the affected page.

Affected Products

WeGIA (wegia:wegia) versions prior to 3.2.6
The html/funcionario/dependente_parentesco_adicionar.php endpoint
The html/funcionario/dependente_parentesco_listar.php listing page that renders the stored value

Discovery Timeline

2025-01-13 - CVE-2025-22616 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22616

Vulnerability Analysis

The vulnerable endpoint accepts an HTTP POST request containing the descricao field and writes the value directly into the funcionario_dependente_parentesco table. Because the input is neither validated nor encoded on output, any HTML or JavaScript submitted by an attacker is stored verbatim. When another user, typically a staff member managing dependents, opens the listing view, the browser interprets the payload as active content.

This creates a classic persistent XSS condition. The attacker only needs to submit the payload once, and it executes for every subsequent visitor to the affected page. Because WeGIA is used by charitable institutions to manage employee and beneficiary data, a successful payload can pivot to session theft, credential harvesting, or unauthorized administrative actions.

Root Cause

The root cause is missing input sanitization on the descricao POST parameter combined with unescaped rendering on the listing page. The pre-patch code assigned $_POST["descricao"] directly to a variable and inserted it via a prepared statement. Prepared statements prevent SQL injection but do not neutralize HTML or JavaScript, leaving the stored value dangerous when reflected back to users.

Attack Vector

An unauthenticated or low-privileged attacker submits a crafted POST request to dependente_parentesco_adicionar.php containing a JavaScript payload in the descricao field. The payload is stored and later executed in the context of any authenticated user viewing the dependents list, enabling session hijacking or actions within the WeGIA application.

php

// Patch applied in html/funcionario/dependente_parentesco_adicionar.php
try {
    $pdo = Conexao::connect();

    // Vulnerable line (removed):
    // $descricao = $_POST["descricao"];

    // Fixed line: input is trimmed and sanitized before storage
    $descricao = trim(filter_input(INPUT_POST, 'descricao', FILTER_SANITIZE_STRING));

    if (empty($descricao)) {
        echo "Descrição não pode estar vazia.";
        exit();
    }

    $stmt = $pdo->prepare("INSERT INTO funcionario_dependente_parentesco (descricao) VALUES (:descricao)");
    $stmt->bindParam(':descricao', $descricao);
    $stmt->execute();

    echo "Dependente adicionado com sucesso.";
} catch (PDOException $e) {
    // error handling
}

Source: GitHub commit 1825e235. The patch replaces the raw $_POST read with filter_input using FILTER_SANITIZE_STRING to strip HTML tags before the value reaches the database.

Detection Methods for CVE-2025-22616

Indicators of Compromise

POST requests to /html/funcionario/dependente_parentesco_adicionar.php where the descricao parameter contains <script>, onerror=, onload=, or javascript: substrings.
Rows in the funcionario_dependente_parentesco table whose descricao column contains HTML tags or JavaScript event handlers.
Unusual outbound requests from authenticated user browsers to attacker-controlled hosts shortly after opening the dependents list.

Detection Strategies

Review web server access logs for POST requests to the vulnerable endpoint with suspicious payloads in the request body.
Run a database query against funcionario_dependente_parentesco to locate stored entries containing <, >, or JavaScript keywords.
Deploy a Web Application Firewall (WAF) rule that flags XSS patterns targeting the descricao parameter on WeGIA endpoints.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script executions originating from the WeGIA UI.
Monitor for anomalous session activity, such as concurrent sessions from different geographies for the same WeGIA account.
Alert on any modification to files under html/funcionario/ on the WeGIA server to detect tampering during incident response.

How to Mitigate CVE-2025-22616

Immediate Actions Required

Upgrade WeGIA to version 3.2.6 or later, which contains the sanitization fix for the descricao parameter.
Audit the funcionario_dependente_parentesco table and remove or sanitize any existing entries containing HTML or script content.
Force a session reset for all WeGIA users to invalidate any tokens that may have been exposed by prior exploitation.

Patch Information

The fix is delivered in WeGIA 3.2.6 via commit 1825e235aa4ab1b8b641a02c3ec8bc32ea7a8433. Refer to the GitHub Security Advisory GHSA-xm3h-x3rv-whr5 and the upstream commit for full details.

Workarounds

The vendor states there are no known workarounds; upgrading is the only supported remediation.
As a temporary compensating control, restrict access to dependente_parentesco_adicionar.php via network ACLs or authentication proxies until the patch is applied.
Deploy a WAF rule that rejects requests containing HTML tags or JavaScript event handlers in the descricao field.

bash

# Example ModSecurity rule to block XSS payloads targeting the descricao parameter
SecRule REQUEST_URI "@contains /dependente_parentesco_adicionar.php" \
    "chain,phase:2,deny,status:403,id:1002216,\
    msg:'CVE-2025-22616 - Blocked XSS attempt on WeGIA descricao parameter'"
    SecRule ARGS:descricao "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none,t:urlDecodeUni"