CVE-2025-23032: Wegia Wegia Stored XSS Vulnerability

CVE-2025-23032 Overview

CVE-2025-23032 is a Stored Cross-Site Scripting (XSS) vulnerability in WeGIA, an open source web manager focused on Portuguese-language charitable institutions. The flaw resides in the adicionar_escala.php endpoint, which fails to validate or sanitize the escala parameter. Attackers can inject malicious scripts that are persisted server-side and executed in every user's browser that loads the affected page. The vulnerability is classified under [CWE-79] and was addressed in WeGIA version 3.2.6.

Critical Impact
Attackers can inject persistent JavaScript payloads that execute in victims' browsers, enabling session hijacking, credential theft, and unauthorized actions on behalf of authenticated users.

Affected Products

WeGIA versions prior to 3.2.6
Component: controle/QuadroHorarioControle.php
Component: html/funcionario/profile_funcionario.php

Discovery Timeline

2025-01-14 - CVE-2025-23032 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23032

Vulnerability Analysis

The vulnerability exists in the adicionarEscala() function within controle/QuadroHorarioControle.php. The function used PHP's extract($_REQUEST) to unpack request parameters directly into local variables without any sanitization. Attacker-supplied content submitted through the escala parameter is written to the database and later rendered as raw HTML inside <option> elements in html/funcionario/profile_funcionario.php. When any user loads the affected page, the stored payload executes in their browser context.

Root Cause

The root cause is the absence of input validation on the escala parameter and the absence of output encoding when writing the stored value back to HTML. The application relied on extract($_REQUEST) for parameter handling, which imports untrusted input verbatim. Combined with unescaped output in the schedule dropdown, this created a persistent injection sink.

Attack Vector

An unauthenticated or low-privileged attacker sends a POST request to adicionar_escala.php with a JavaScript payload in the escala field. The payload is stored in the escala_quadro_horario table. When any authenticated user, including administrators, opens the employee profile page, the malicious script executes with the victim's session privileges.

php

// Patch in controle/QuadroHorarioControle.php
     public function adicionarEscala(){
-        extract($_REQUEST);
+        $escala = trim(filter_input(INPUT_POST, 'escala', FILTER_SANITIZE_STRING));
+        $nextPage = trim(filter_input(INPUT_POST, 'nextPage', FILTER_SANITIZE_URL));
+
+        if(!$escala || strlen($escala) == 0){
+            http_response_code(400);
+            echo json_encode(['erro' => 'A escala não pode ser vazia.']);
+            exit();
+        }
+
         session_start();
         try {
             $log = (new QuadroHorarioDAO())->adicionarEscala($escala);

Source: WeGIA commit 09affa8

Detection Methods for CVE-2025-23032

Indicators of Compromise

POST requests to adicionar_escala.php containing <script>, onerror=, onload=, or javascript: tokens in the escala parameter.
Database rows in the escala_quadro_horario table where the descricao column contains HTML tags or JavaScript event handlers.
Anomalous outbound requests from client browsers that load the employee profile page, potentially indicating cookie exfiltration.

Detection Strategies

Inspect web server access logs for POST requests to adicionar_escala.php and correlate against the payload body when available.
Deploy a Web Application Firewall (WAF) rule that flags HTML control characters in the escala POST parameter.
Run periodic SQL queries against escala_quadro_horario.descricao to identify stored payloads containing angle brackets or event handlers.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script violations on employee profile pages.
Track session anomalies such as unexpected privilege changes or requests originating from active user sessions immediately after loading affected pages.
Log all administrative reads of profile_funcionario.php and compare against baseline usage to identify triggered payloads.

How to Mitigate CVE-2025-23032

Immediate Actions Required

Upgrade WeGIA to version 3.2.6 or later, which contains the sanitization and output-encoding fixes.
Audit the escala_quadro_horario table for stored payloads and remove any rows containing HTML or JavaScript in the descricao column.
Force session invalidation for all users who may have loaded the affected page while a payload was present.

Patch Information

The fix is committed in WeGIA commit 09affa8 and documented in GitHub Security Advisory GHSA-6mm4-fcfv-55x3. The patch replaces extract($_REQUEST) with filter_input() using FILTER_SANITIZE_STRING and adds htmlspecialchars() when rendering the schedule description in HTML output.

Workarounds

No official workarounds are documented by the vendor. Upgrading to version 3.2.6 is the only supported remediation.
As a compensating control, deploy a WAF rule to block requests to adicionar_escala.php containing script tags or HTML event handlers until the patch is applied.

bash

# Verify the installed WeGIA version and upgrade
cd /path/to/WeGIA
git fetch --tags
git checkout 3.2.6
# Verify the patched function no longer uses extract($_REQUEST)
grep -n "extract(\$_REQUEST)" controle/QuadroHorarioControle.php
grep -n "htmlspecialchars" html/funcionario/profile_funcionario.php