CVE-2025-24020: WeGIA Open Redirect Vulnerability

CVE-2025-24020 Overview

CVE-2025-24020 is an open redirect vulnerability affecting WeGIA, a web-based management application for charitable institutions. The flaw exists in the control.php endpoint of WeGIA versions up to and including 3.2.10. Attackers can manipulate the nextPage parameter to redirect authenticated users to arbitrary external URLs without any validation. The vendor addressed the issue in version 3.2.11. The vulnerability is tracked under CWE-601: URL Redirection to Untrusted Site.

Critical Impact
Attackers can leverage the nextPage parameter to redirect authenticated WeGIA users to attacker-controlled sites, enabling phishing campaigns and credential harvesting against charitable institution staff.

Affected Products

WeGIA versions up to and including 3.2.10
The vulnerable component is the control.php endpoint
Fixed in WeGIA 3.2.11

Discovery Timeline

2025-01-21 - CVE-2025-24020 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24020

Vulnerability Analysis

WeGIA is a PHP-based management platform used by charitable organizations. The control.php endpoint accepts a nextPage query parameter that determines where the application redirects the user after processing a request. In versions up to 3.2.10, the application performs the redirect without validating whether the destination is an internal path or an external URL.

This behavior falls under CWE-601, URL Redirection to Untrusted Site (Open Redirect). While the flaw does not allow direct code execution or data exfiltration, it undermines the trust boundary between the WeGIA application and the browser session, letting attackers weaponize the legitimate WeGIA domain to stage phishing pages.

Root Cause

The vendor advisory attributes the root cause to missing validation of the nextPage parameter. The endpoint treats any user-supplied value, including fully qualified external URLs, as a valid redirection target. There is no allowlist of internal paths and no origin check before issuing the HTTP redirect response.

Attack Vector

Exploitation requires an authenticated user to click a crafted link that points to the legitimate WeGIA host but includes an attacker-controlled nextPage value, for example https://victim-wegia.example/control.php?nextPage=https://attacker.example/login. The victim's browser follows the redirect issued by WeGIA and lands on the attacker's site, which can then mimic the WeGIA login page to harvest credentials or deliver malware.

Because the initial link originates from a trusted domain, phishing filters and users relying on domain inspection are more likely to trust the request. No verified public proof-of-concept is currently listed in ExploitDB.

No verified exploitation code is available. See the vendor advisory for technical details:
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-27g8-5q48-xmw6

Detection Methods for CVE-2025-24020

Indicators of Compromise

HTTP requests to control.php where the nextPage parameter contains an absolute URL, a scheme prefix such as http:// or https://, or protocol-relative values beginning with //.
Web server access logs showing 302 or 303 responses from control.php with Location headers pointing to external hostnames.
Referrer telemetry on external phishing infrastructure showing traffic sourced from the WeGIA domain.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the nextPage query parameter and block values containing external URLs or encoded variants such as %2F%2F.
Correlate authentication events with outbound redirect patterns to flag sessions redirected to unfamiliar domains shortly after login.
Review reverse proxy or CDN logs for anomalous Location response headers originating from WeGIA endpoints.

Monitoring Recommendations

Enable verbose HTTP logging on the WeGIA host to capture full query strings for the control.php endpoint.
Forward WeGIA web logs to a centralized log platform and alert on redirects whose destination host does not match the WeGIA canonical domain.
Track user reports of unexpected logout screens or credential prompts that appear immediately after clicking WeGIA links.

How to Mitigate CVE-2025-24020

Immediate Actions Required

Upgrade WeGIA to version 3.2.11 or later, which contains the vendor fix delivered in commit 89d98bf.
Audit existing WeGIA deployments for the presence of control.php and confirm the installed version against the WeGIA v3.2.11 release notes.
Notify WeGIA users of the phishing risk and reinforce guidance to verify the final destination of any WeGIA-generated links.

Patch Information

The vendor released a patch in WeGIA 3.2.11. Details are published in the GitHub Security Advisory GHSA-27g8-5q48-xmw6 and the corresponding commit on GitHub. Administrators should apply the update from the official WeGIA repository rather than mirroring older tags.

Workarounds

If patching is not immediately feasible, restrict the nextPage parameter at the reverse proxy layer to a strict allowlist of relative paths within the WeGIA application.
Strip or reject nextPage values that contain ://, backslashes, or leading // sequences before the request reaches control.php.
Enforce Content Security Policy (CSP) and browser-side protections that warn users when leaving the WeGIA origin.

bash

# Example NGINX rule to block absolute URLs in the nextPage parameter
if ($arg_nextPage ~* "^(https?:)?//") {
    return 400;
}