CVE-2025-23033: Wegia Stored XSS Vulnerability

CVE-2025-23033 Overview

CVE-2025-23033 is a Stored Cross-Site Scripting (XSS) vulnerability in WeGIA, an open source web manager targeted at Portuguese-language charitable institutions. The flaw resides in the adicionar_situacao.php endpoint, which fails to validate and sanitize the situacao POST parameter. Attackers can inject JavaScript payloads that are persisted in the database and executed in the browser of any user who loads the affected page. The issue is tracked under [CWE-79] and has been resolved in WeGIA version 3.2.6.

Critical Impact
Authenticated or unauthenticated attackers can inject persistent JavaScript into the situacao field, executing arbitrary script in the context of every user who views the affected page.

Affected Products

WeGIA (LabRedesCefetRJ/WeGIA) versions prior to 3.2.6
Vulnerable endpoint: dao/adicionar_situacao.php
Vulnerable data display: dao/exibir_situacao.php

Discovery Timeline

2025-01-14 - CVE-2025-23033 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23033

Vulnerability Analysis

The vulnerability is a Stored XSS defect in the adicionar_situacao.php endpoint of WeGIA. The endpoint accepts a situacao parameter via HTTP POST and inserts it directly into the situacao database table without input sanitization or output encoding. When users subsequently retrieve the record through exibir_situacao.php, the injected script executes in their browser session. This allows attackers to steal session cookies, perform actions as the victim, or pivot to other authenticated functionality within the WeGIA application.

Root Cause

The original adicionar_situacao.php implementation applied only trim() to the incoming situacao value before passing it to a prepared SQL INSERT statement. While parameterized queries prevent SQL injection, they do not neutralize HTML or JavaScript payloads. The corresponding exibir_situacao.php endpoint returned stored values in a JSON response without applying htmlspecialchars(), allowing the raw payload to reach the DOM. The endpoints also lacked authentication and authorization checks, making the attack surface reachable without prior session validation.

Attack Vector

An attacker sends a crafted HTTP POST request to adicionar_situacao.php with a situacao value containing a JavaScript payload. The application stores the payload verbatim. When any authenticated user opens a page that renders the situation list through exibir_situacao.php, the payload executes in their browser context, enabling session theft, credential harvesting, or unauthorized administrative actions.

php

// Security patch in dao/adicionar_situacao.php - Resolução XSS [Issue #844]
 <?php
+//Requisições necessárias
 require_once 'Conexao.php';
+require_once '../html/permissao/permissao.php';
 
-$situacao = trim($_POST["situacao"]);
+//Verifica se um usuário está logado e possui as permissões necessárias
+session_start();
+permissao($_SESSION['id_pessoa'], 11, 3);
+
+//Sanitiza a entrada.
+$situacao = trim(filter_input(INPUT_POST, 'situacao', FILTER_SANITIZE_STRING));
 
 if(!$situacao || empty($situacao)){
 	http_response_code(400);
 	exit('Erro, a descrição de uma nova situação não pode ser vazia.');
 }
 
+//Executa a consulta no banco de dados da aplicação
 try {
-	$sql = "INSERT into situacao(situacoes) values(:situacao)";
+	$sql = "INSERT INTO situacao(situacoes) VALUES (:situacao)";
 	$pdo = Conexao::connect();
 	$stmt = $pdo->prepare($sql);
 	$stmt->bindParam(':situacao', $situacao);
 	$stmt->execute();
 } catch (PDOException $e) {
+	http_response_code(500);
 	echo 'Erro ao inserir uma nova situação no banco de dados: '.$e->getMessage();
 }

Source: GitHub Commit e6bfae0. The patch adds authenticated session and permission checks, applies filter_input with FILTER_SANITIZE_STRING on the situacao parameter, and returns proper HTTP status codes on failure.

php

// Security patch in dao/exibir_situacao.php - Resolução XSS [Issue #844]
 <?php
-	require_once'Conexao.php';
-	$pdo = Conexao::connect();
+//Requisições necessárias
+require_once 'Conexao.php';
+require_once '../html/permissao/permissao.php';
 
-	$sql = 'select * from situacao';
+//Verifica se um usuário está logado e possui as permissões necessárias
+session_start();
+permissao($_SESSION['id_pessoa'], 11, 3);
+
+$pdo = Conexao::connect();
+
+try {
+	$sql = 'SELECT * FROM situacao';
 	$stmt = $pdo->query($sql);
 	$resultado = array();
 	while ($row = $stmt->fetch()) {
-    	$resultado[] = array('id_situacao'=>$row['id_situacao'],'situacoes'=>$row['situacoes']);
+		$resultado[] = array('id_situacao' => $row['id_situacao'], 'situacoes' => htmlspecialchars($row['situacoes']));
 	}
 	echo json_encode($resultado);
-?>
\ No newline at end of file
+} catch (PDOException $e) {
+	http_response_code(500);
+	echo $e->getMessage();
+}

Source: GitHub Commit e6bfae0. The fix wraps stored values with htmlspecialchars() on output and enforces permission checks before returning the situation list.

Detection Methods for CVE-2025-23033

Indicators of Compromise

HTTP POST requests to adicionar_situacao.php containing HTML tags, <script> blocks, or JavaScript event handlers such as onerror= and onload= in the situacao parameter.
Database rows in the situacao table where the situacoes column contains angle brackets, javascript: URIs, or encoded script payloads.
Unexpected outbound requests from user browsers to attacker-controlled domains after loading pages that render situation data.

Detection Strategies

Inspect WeGIA web server access logs for POST bodies to /dao/adicionar_situacao.php matching XSS regex patterns.
Run a database query against the situacao table to enumerate any rows containing <, >, script, or on[a-z]+= sequences.
Deploy WAF rules that block script-like payloads targeting the situacao parameter and alert on repeated 200 responses to injection attempts.

Monitoring Recommendations

Enable HTTP request body logging for the WeGIA application and forward logs to a centralized SIEM for indexing and rule-based alerting.
Track privileged user sessions on WeGIA and alert on anomalous behavior such as unexpected administrative actions or session token reuse from new IP addresses.
Monitor egress DNS and HTTP traffic from WeGIA client workstations for connections to unknown domains that could indicate exfiltration by a stored XSS payload.

How to Mitigate CVE-2025-23033

Immediate Actions Required

Upgrade WeGIA to version 3.2.6 or later, which includes the sanitization and permission checks in the vendor patch.
Audit the situacao database table for pre-existing malicious content and purge or neutralize any records containing script payloads.
Rotate session tokens and administrative credentials for users who may have interacted with a compromised installation.

Patch Information

The upstream fix is available in the GitHub Security Advisory GHSA-r8fq-hqr2-v5j9 and is delivered in WeGIA commit e6bfae0. Version 3.2.6 applies filter_input with FILTER_SANITIZE_STRING to the situacao POST parameter, enforces session-based permission checks on both adicionar_situacao.php and exibir_situacao.php, and encodes output through htmlspecialchars() before returning JSON.

Workarounds

The vendor states there are no known workarounds. Upgrading to 3.2.6 is the only supported remediation.
As a compensating control, place WeGIA behind a web application firewall configured to block script tags and JavaScript event handlers in POST parameters until the patch is applied.

bash

# Example WAF/ModSecurity rule to block script payloads in the situacao parameter
SecRule ARGS:situacao "@rx (?i)(<script|javascript:|on[a-z]+\s*=)" \
    "id:1002305,phase:2,deny,status:403,\
    msg:'CVE-2025-23033 - Blocked XSS payload in WeGIA situacao parameter'"