CVE-2025-23034: Wegia Wegia XSS Vulnerability

CVE-2025-23034 Overview

CVE-2025-23034 is a reflected Cross-Site Scripting (XSS) vulnerability in WeGIA, an open source web manager for Portuguese-language charitable institutions. The flaw resides in the tags.php endpoint, where the msg_e parameter is echoed into the HTTP response without validation or sanitization. Attackers can craft URLs containing malicious JavaScript that executes in the victim's browser when the link is opened. The issue is tracked as [CWE-79] and has been fixed in WeGIA version 3.2.6.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's authenticated browser session, enabling session theft, credential harvesting, and unauthorized actions against the WeGIA application.

Affected Products

WeGIA versions prior to 3.2.6
html/socio/sistema/tags.php endpoint
Deployments accepting the msg_e query parameter

Discovery Timeline

2025-01-14 - CVE-2025-23034 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23034

Vulnerability Analysis

The vulnerability exists in the tags.php endpoint of the WeGIA application. When the endpoint receives a request containing the msg_e GET parameter, the value is concatenated directly into an HTML alert-danger<div> and echoed back to the client. No output encoding or input filtering is applied. This gives attackers a straightforward reflection sink for injecting arbitrary HTML and JavaScript. Because the reflection occurs inside the authenticated web manager interface, injected scripts run in the security context of the logged-in administrator or staff user.

Root Cause

The root cause is missing output encoding when rendering user-controlled input. The vulnerable branch reads $_GET['msg_e'] and passes it into echo without calling htmlspecialchars or any equivalent sanitizer. This violates the neutralization requirement described by [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL to the WeGIA tags.php endpoint with a JavaScript payload in the msg_e parameter and delivers it via phishing or a malicious referrer. When an authenticated user clicks the link, the payload executes in their browser and can exfiltrate session cookies, submit forged requests to WeGIA, or pivot to further administrative actions.

php

// Patch from html/socio/sistema/tags.php - Resolução XSS [Issue #861]
if (isset($_GET['msg_c'])) {
    $msg = $_GET['msg_c'];
    echo ('<div class="alert alert-success" role="alert">
-                                            ' . $msg . '
+                                            ' . htmlspecialchars($msg) . '
                                          </div>');
} else if (isset($_GET['msg_e'])) {
    $msg = $_GET['msg_e'];
    echo ('<div class="alert alert-danger" role="alert">
-                                            ' . $msg . '
+                                            ' . htmlspecialchars($msg) . '
                                          </div>');
}
// Source: https://github.com/LabRedesCefetRJ/WeGIA/commit/8a37021417d9c55e61392b3cc52baa3c73102bab

The patch wraps both msg_c and msg_e values with htmlspecialchars, converting special characters to HTML entities and preventing script execution.

Detection Methods for CVE-2025-23034

Indicators of Compromise

Requests to tags.php containing msg_e parameter values with HTML tags such as <script>, <img, <svg, or onerror=.
Web server access logs showing URL-encoded payloads like %3Cscript%3E in the msg_e query string.
Outbound requests from user browsers to attacker-controlled hosts immediately after visiting a WeGIA URL.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the msg_e parameter for HTML and JavaScript metacharacters.
Enable server-side request logging on the WeGIA html/socio/sistema/tags.php path and alert on suspicious query strings.
Review referrer headers for external domains linking directly to tags.php with populated msg_e values.

Monitoring Recommendations

Correlate authenticated WeGIA sessions with anomalous DOM events or unexpected outbound HTTP traffic from user endpoints.
Monitor for repeated 200-status responses to tags.php requests originating from phishing-adjacent domains.
Track WeGIA installations against the running version to identify hosts still exposing pre-3.2.6 code paths.

How to Mitigate CVE-2025-23034

Immediate Actions Required

Upgrade WeGIA to version 3.2.6 or later, which applies htmlspecialchars encoding to the vulnerable parameters.
Audit web server logs for prior exploitation attempts targeting tags.php with msg_e payloads.
Invalidate active administrator sessions after patching to eliminate any tokens potentially captured through XSS.

Patch Information

The fix is committed in WeGIA commit 8a37021 and documented in the GHSA-v68m-2rvf-8r25 advisory. Both the msg_c and msg_e GET parameters are now passed through htmlspecialchars before being emitted into the response.

Workarounds

No official workarounds exist; the vendor advises upgrading to 3.2.6.
As a compensating control, deploy a WAF rule that blocks requests to tags.php when the msg_e parameter contains angle brackets, javascript:, or event handler substrings.
Enforce a strict Content Security Policy (CSP) that disallows inline script execution to reduce impact until patching is completed.

bash

# Example ModSecurity rule blocking script payloads in msg_e
SecRule REQUEST_URI "@rx /tags\.php" \
    "chain,phase:2,deny,status:403,id:1002303,\
    msg:'CVE-2025-23034 WeGIA XSS attempt in msg_e'"
    SecRule ARGS:msg_e "@rx (?i)(<script|onerror=|javascript:|<svg|<img)" \
        "t:none,t:urlDecodeUni"