CVE-2025-23037: WeGIA Stored XSS Vulnerability

CVE-2025-23037 Overview

CVE-2025-23037 is a Stored Cross-Site Scripting (XSS) vulnerability affecting WeGIA, an open source web manager focused on Portuguese-language charitable institutions. The flaw resides in the control.php endpoint, where the cargo parameter accepts unsanitized user input. Attackers can inject malicious scripts that are persisted server-side and executed in the browser of any user who loads the affected page. The maintainers addressed the issue in version 3.2.6 by applying input filtering in CargoControle.php. No workarounds exist for unpatched deployments.

Critical Impact
Persistent script execution in victim browsers can lead to session theft, credential harvesting, and unauthorized actions performed under authenticated user contexts within the WeGIA application.

Affected Products

WeGIA versions prior to 3.2.6
WeGIA control.php endpoint
WeGIA CargoControle.php component

Discovery Timeline

2025-01-14 - CVE-2025-23037 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23037

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw classified under [CWE-79]. The control.php endpoint in WeGIA accepts input through the cargo parameter without applying HTML encoding or input filtering. Submitted values are written directly to the database and later rendered into pages consumed by other users. When those pages load, the browser parses the attacker-controlled payload as executable script within the WeGIA origin.

Exploitation requires an attacker to submit a crafted request to the vulnerable endpoint and a victim to subsequently visit an affected view. Because the payload is stored, a single injection can affect every user who accesses the affected page until the record is removed.

Root Cause

The application fails to validate or sanitize the cargo parameter received via both JSON payloads and standard form submissions. The CargoControle.php handler read the value using trim($data["cargo"]) and trim($_POST["cargo"]) without applying any filter, allowing raw HTML and JavaScript to reach persistent storage.

Attack Vector

An unauthenticated attacker submits a POST request to control.php with a script payload in the cargo field. The payload is stored and rendered on subsequent page loads, executing under the victim's session in the WeGIA domain.

php

// Security patch in controle/CargoControle.php
// Source: https://github.com/LabRedesCefetRJ/WeGIA/commit/3e4d5a3302164617314edfd6dfdef063dc255cbd

            // Decodifica o JSON
            $data = json_decode($json, true);

-            $cargoDescricao = trim($data["cargo"]);
+            $cargoDescricao = trim(filter_var($data['cargo'], FILTER_SANITIZE_STRING));
        } else {
            // Recebe os dados do formulário normalmente
-            $cargoDescricao = trim($_POST["cargo"]);
+            $cargoDescricao = trim(filter_input(INPUT_POST, 'cargo', FILTER_SANITIZE_STRING));
        }

The patch introduces FILTER_SANITIZE_STRING filtering on both JSON and form-based input paths before the value is persisted.

Detection Methods for CVE-2025-23037

Indicators of Compromise

POST requests to control.php containing <script>, onerror=, onload=, or JavaScript URI schemes in the cargo parameter.
Database records in WeGIA cargo tables containing HTML tags or JavaScript event handlers.
Unexpected outbound requests from user browsers to attacker-controlled domains after loading pages that render the cargo field.

Detection Strategies

Inspect web server access logs for anomalous character sequences (%3Cscript, javascript:, angle brackets) in requests targeting control.php.
Query the WeGIA database for stored cargo values containing markup characters or script keywords.
Deploy Content Security Policy (CSP) reporting to identify blocked script executions originating from stored fields.

Monitoring Recommendations

Enable web application firewall (WAF) rules that flag XSS patterns on the cargo parameter and other WeGIA form fields.
Monitor authentication and session activity for anomalies following user access to pages that render cargo data.
Correlate application logs with browser CSP violation reports to detect injection attempts.

How to Mitigate CVE-2025-23037

Immediate Actions Required

Upgrade WeGIA to version 3.2.6 or later, which applies FILTER_SANITIZE_STRING to the cargo parameter.
Audit the WeGIA database for previously stored payloads in cargo fields and remove or neutralize any malicious content.
Rotate session tokens and administrator credentials if injection activity is suspected.

Patch Information

The fix is available in WeGIA 3.2.6. See the GitHub Security Advisory GHSA-rjjp-w2wm-7f9j and the remediation commit for the specific changes to CargoControle.php.

Workarounds

No official workarounds exist. Upgrading to version 3.2.6 is the only supported remediation.
As a compensating control until patching, restrict network access to the WeGIA application and place it behind a WAF configured to block XSS payloads.

bash

# Upgrade WeGIA to the patched release
git fetch --tags
git checkout 3.2.6
# Restart the web server after deployment
sudo systemctl restart apache2