CVE-2025-22619: Wegia Wegia Reflected XSS Vulnerability

CVE-2025-22619 Overview

CVE-2025-22619 is a Reflected Cross-Site Scripting (XSS) vulnerability in WeGIA, an open source web manager focused on Portuguese-language charitable institutions. The flaw resides in the editar_permissoes.php endpoint, which accepts the msg_c GET parameter without sanitization. Attackers can craft a malicious URL that injects JavaScript executed in the victim's browser session. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation. Maintainers addressed the issue in WeGIA release 3.2.6. No workarounds exist, so upgrading is the only remediation path.

Critical Impact
Attackers can execute arbitrary JavaScript in an authenticated administrator's browser, enabling session theft, permission tampering, and unauthorized actions within the WeGIA management console.

Affected Products

WeGIA versions prior to 3.2.6
html/geral/editar_permissoes.php endpoint
Deployments exposing the msg_c parameter to untrusted input

Discovery Timeline

2025-01-13 - CVE-2025-22619 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22619

Vulnerability Analysis

The vulnerability exists in the permissions editor endpoint html/geral/editar_permissoes.php. The script reads the msg_c query parameter and embeds its value directly into an HTML alert block returned to the client. Because the value is concatenated into the response without HTML entity encoding, attacker-controlled markup and script content execute in the victim's browser. Successful exploitation runs in the same origin as the WeGIA application, so the injected script inherits access to cookies, DOM state, and any authenticated session held by the target. This is a reflected variant, meaning delivery typically requires the victim to click a crafted link.

Root Cause

The root cause is missing output encoding. The affected code path echoes $_GET['msg_c'] into an HTML fragment used to render a Bootstrap alert alert-success div. No call to htmlspecialchars, htmlentities, or any sanitization routine is performed before rendering. Any request containing HTML or <script> payloads in msg_c is reflected verbatim.

Attack Vector

Exploitation requires the attacker to deliver a crafted link, typically through phishing, chat, or a malicious referrer. When an authenticated WeGIA user opens the link, the payload executes with the privileges of that user. Because WeGIA manages charitable institution data and permissions, a targeted administrator can be coerced into performing state-changing operations via the injected script.

php

// Patched code from html/geral/editar_permissoes.php
if(isset($_GET['msg_c'])){
    $msg = $_GET['msg_c'];
    echo('<div class="alert alert-success" role="alert">
-        '. $msg .'
+        '. htmlspecialchars($msg) .'
      </div>');
}
if($permissao == 1){
// Source: [WeGIA commit f1233c3](https://github.com/LabRedesCefetRJ/WeGIA/commit/f1233c30f00398f7a02fd9dd9cd46fb35098f2a4)

The patch wraps the reflected value with htmlspecialchars(), converting characters such as <, >, and " into HTML entities so browsers render them as text rather than markup.

Detection Methods for CVE-2025-22619

Indicators of Compromise

HTTP GET requests to /html/geral/editar_permissoes.php containing msg_c parameter values with <script, onerror=, onload=, or javascript: substrings.
Web server access logs showing URL-encoded payloads such as %3Cscript%3E in the msg_c query string.
Referrer entries pointing to unknown external domains preceding requests against editar_permissoes.php.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects msg_c for HTML tags and script-like patterns and blocks or logs matches.
Enable server-side logging of full query strings on the WeGIA host to enable retrospective hunting for XSS payloads.
Correlate suspicious msg_c requests with subsequent administrative actions in WeGIA audit trails to identify successful exploitation.

Monitoring Recommendations

Monitor for outbound requests from browsers of WeGIA administrators to unfamiliar domains shortly after visiting the application.
Alert on Content Security Policy (CSP) violation reports if a policy is configured on the WeGIA deployment.
Track version banners and file hashes of editar_permissoes.php to confirm upgraded instances remain on 3.2.6 or later.

How to Mitigate CVE-2025-22619

Immediate Actions Required

Upgrade WeGIA to version 3.2.6 or later, which applies htmlspecialchars() sanitization to the msg_c parameter.
Audit web server logs for prior requests to editar_permissoes.php containing suspicious msg_c values and review administrator activity that followed.
Force session invalidation for administrative accounts if evidence of exploitation exists.

Patch Information

The fix is committed in f1233c30f00398f7a02fd9dd9cd46fb35098f2a4 and shipped in WeGIA 3.2.6. Reference materials are available in the WeGIA GitHub Security Advisory GHSA-jfjj-7rgc-6j2m and the upstream commit diff.

Workarounds

No official workaround exists. The maintainers state upgrading is the only remediation.
As a compensating control, restrict access to editar_permissoes.php via network ACLs or reverse proxy rules while upgrade planning is underway.
Deploy a strict Content Security Policy that disallows inline scripts to limit the impact of any reflected payload.

bash

# Example nginx rule to block script-like payloads in msg_c until patch is deployed
location /html/geral/editar_permissoes.php {
    if ($arg_msg_c ~* "(<|%3C)(script|img|svg|iframe)") {
        return 403;
    }
    proxy_pass http://wegia_backend;
}