CVE-2025-23035: Wegia Wegia Stored XSS Vulnerability

CVE-2025-23035 Overview

CVE-2025-23035 is a stored Cross-Site Scripting (XSS) vulnerability in WeGIA, an open source web manager focused on Portuguese-language charitable institutions. The flaw resides in the adicionar_tipo_quadro_horario.php endpoint, which fails to validate and sanitize the tipo parameter. Attackers can inject malicious JavaScript that persists on the server and executes in the browser of any user who loads the affected page. The issue is tracked under [CWE-79] and has been fixed in WeGIA version 3.2.6.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in every victim's browser session, enabling session theft, credential harvesting, and administrative account takeover.

Affected Products

WeGIA (wegia:wegia) versions prior to 3.2.6
adicionar_tipo_quadro_horario.php endpoint
controle/QuadroHorarioControle.php controller component

Discovery Timeline

2025-01-14 - CVE-2025-23035 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23035

Vulnerability Analysis

The vulnerability exists in the adicionarTipo() method of controle/QuadroHorarioControle.php. The original implementation used PHP's extract($_REQUEST) to unpack user-controlled request data directly into local variables. The tipo value flowed unfiltered into the database and was later rendered into HTML <option> elements without output encoding in html/funcionario/cadastro_funcionario.php.

Because the payload is stored server-side, every authenticated user who loads the schedule-type selector triggers execution of the attacker's script. The persistent nature of the attack allows adversaries to compromise multiple users, including privileged administrators, from a single injection.

Root Cause

The root cause is missing input validation on write and missing output encoding on read. User input from the tipo POST parameter was accepted verbatim, and the stored value was echoed into an HTML context using PHP string concatenation without invoking htmlspecialchars().

Attack Vector

An attacker submits a crafted tipo value containing HTML or JavaScript to the adicionar_tipo_quadro_horario.php endpoint. The payload is persisted in the escala_quadro_horario table. When another user visits a page that renders these records, the browser executes the attacker's script in the victim's session context.

php

// Patch applied in controle/QuadroHorarioControle.php
public function adicionarTipo()
{
    $tipo = trim(filter_input(INPUT_POST, 'tipo', FILTER_SANITIZE_STRING));
    $nextPage = trim(filter_input(INPUT_POST, 'nextPage', FILTER_SANITIZE_URL));

    if (!$tipo || strlen($tipo) == 0) {
        http_response_code(400);
        echo json_encode(['erro' => 'O tipo não pode ser vazio.']);
        exit();
    }

    session_start();
    try {
        $log = (new QuadroHorarioDAO())->adicionarTipo($tipo);
        $_SESSION['msg'] = $log;
    } catch (PDOException $e) {
        // error handling
    }
}

// Patch applied in html/funcionario/cadastro_funcionario.php
foreach ($escala as $key => $value) {
    echo ("<option value=" . $value["id_escala"] . ">" 
        . htmlspecialchars($value["descricao"]) . "</option>");
}

Source: GitHub commit 673d7a3

Detection Methods for CVE-2025-23035

Indicators of Compromise

POST requests to /html/configuracao/adicionar_tipo_quadro_horario.php containing HTML tags, <script>, javascript:, or event handlers such as onerror= in the tipo parameter.
Database rows in escala_quadro_horario.descricao or related schedule-type tables containing angle brackets or JavaScript keywords.
Outbound requests from user browsers to unknown domains shortly after loading pages that render schedule-type selectors.

Detection Strategies

Inspect web server access logs for anomalous request bodies targeting adicionar_tipo_quadro_horario.php with encoded or literal script payloads.
Query the WeGIA database for stored values containing HTML control characters: SELECT * FROM escala_quadro_horario WHERE descricao REGEXP '[<>]'.
Deploy a Web Application Firewall (WAF) rule that inspects POST parameters for common XSS signatures before they reach the application.

Monitoring Recommendations

Enable full HTTP request logging on the WeGIA application tier and forward logs to a centralized analytics platform for pattern review.
Alert on browser-side Content Security Policy (CSP) violation reports originating from authenticated WeGIA sessions.
Track administrative account activity for anomalous session behavior that may indicate cookie or token theft following XSS exploitation.

How to Mitigate CVE-2025-23035

Immediate Actions Required

Upgrade WeGIA to version 3.2.6 or later, which contains the official patch from commit 673d7a3.
Audit the escala_quadro_horario table and related schedule-type storage for previously injected payloads and sanitize or remove offending rows.
Rotate session tokens and credentials for administrators who may have accessed compromised pages before patching.

Patch Information

The fix is delivered in WeGIA 3.2.6 via commit 673d7a36baebb1a0093f421cfd51e3df8a55c84a. The patch replaces extract($_REQUEST) with explicit filter_input() calls using FILTER_SANITIZE_STRING and applies htmlspecialchars() when rendering stored values into HTML <option> elements. See the GitHub Security Advisory GHSA-qfmh-qrr2-5c4g for the coordinated disclosure details.

Workarounds

No official workarounds exist per the vendor advisory. Upgrading to WeGIA 3.2.6 is the only supported remediation.
As a compensating control, restrict access to the affected endpoint via network ACLs or authentication proxies until the upgrade is applied.
Deploy a WAF rule blocking HTML metacharacters in the tipo parameter as a temporary measure.

bash

# Example WAF ModSecurity rule to block XSS payloads on the vulnerable endpoint
SecRule REQUEST_URI "@contains /adicionar_tipo_quadro_horario.php" \
    "chain,phase:2,deny,status:403,id:1002335,\
    msg:'Potential XSS in WeGIA tipo parameter (CVE-2025-23035)'"
    SecRule ARGS:tipo "@rx (?i)(<script|javascript:|onerror=|onload=|<img|<svg)" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"