CVE-2025-27417: WeGIA Stored XSS Vulnerability

CVE-2025-27417 Overview

CVE-2025-27417 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in WeGIA, an open source web manager for institutions targeting Portuguese language users. The flaw resides in the adicionar_status_atendido.php endpoint, which fails to sanitize the status parameter before persisting it to the database. Attackers can inject malicious JavaScript that executes in the browsers of any user viewing the affected page. The vulnerability is fixed in WeGIA version 3.2.16.

Critical Impact
Attackers can inject persistent JavaScript payloads through an unauthenticated endpoint, enabling session hijacking, credential theft, and unauthorized actions performed on behalf of authenticated institutional users.

Affected Products

WeGIA (LabRedesCefetRJ/WeGIA) — all versions prior to 3.2.16
Vulnerable component: dao/adicionar_status_atendido.php
Vulnerable component: dao/exibir_status_atendido.php (output rendering)

Discovery Timeline

2025-03-03 - CVE-2025-27417 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27417

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the WeGIA institution management application. The adicionar_status_atendido.php endpoint accepts a status POST parameter and writes it directly to the database without HTML encoding or input sanitization. When exibir_status_atendido.php later retrieves and returns the stored value in a JSON response, the payload is rendered in the client browser and executes as JavaScript.

Because the injected content is persisted server-side, every subsequent request to the affected page triggers the payload automatically. Attackers can use this vector to steal session cookies, capture form data, pivot to CSRF-style actions, or perform account takeover of administrators managing institutional records.

Root Cause

The root cause is missing input validation on write and missing output encoding on read. The pre-patch code assigned $status = trim($_POST["status"]) with no filtering, and the display endpoint returned the value in the JSON array without applying htmlspecialchars(). This dual failure allows arbitrary HTML and script tags to be stored and rendered.

Attack Vector

Exploitation requires a network-accessible instance of WeGIA and user interaction to view the affected status page. The attacker submits a crafted POST request containing a script payload in the status field. Once stored, any user rendering the status list executes the payload in their authenticated session context.

php

// Patch from commit 0f2644bca2afbdfff21662c51a64679dfba8c2bd
// File: dao/adicionar_status_atendido.php
<?php
+	session_start();
 	require_once 'Conexao.php';
+
+	//verificar permissão
+	require_once '../html/permissao/permissao.php';
+	permissao($_SESSION['id_pessoa'], 12, 3);
 	
-	$status = trim($_POST["status"]);
+	$status = trim(filter_input(INPUT_POST, 'status', FILTER_SANITIZE_STRING));

// File: dao/exibir_status_atendido.php
-    	$resultado[] = array('idatendido_status'=>$row['idatendido_status'],'status'=>$row['status']);
+    	$resultado[] = array('idatendido_status'=>$row['idatendido_status'],'status'=>htmlspecialchars($row['status']));

Source: WeGIA Security Patch Commit

Detection Methods for CVE-2025-27417

Indicators of Compromise

POST requests to /dao/adicionar_status_atendido.php containing <script>, onerror=, onload=, javascript:, or encoded variants in the status parameter.
Database rows in the atendido_status table with status values containing HTML tags or script content.
Outbound requests from user browsers to unknown domains after visiting the WeGIA status page, indicating payload exfiltration.

Detection Strategies

Inspect web server access logs for POST bodies to adicionar_status_atendido.php with suspicious characters (<, >, ', ", =).
Query the WeGIA database for stored status values containing angle brackets or the strings script, onerror, or eval.
Deploy WAF signatures for reflected and stored XSS payloads targeting the status parameter of the WeGIA application path.

Monitoring Recommendations

Monitor for anomalous session activity from institutional user accounts, including unexpected privilege changes or record modifications.
Alert on browser-generated requests containing session cookies or form data being sent to external hosts from WeGIA users.
Track version fingerprints of deployed WeGIA instances and flag any running versions below 3.2.16.

How to Mitigate CVE-2025-27417

Immediate Actions Required

Upgrade WeGIA to version 3.2.16 or later, which contains the official patch for this vulnerability.
Audit the atendido_status database table and remove any rows containing HTML or JavaScript payloads.
Rotate active session tokens and force reauthentication for institutional users who may have been exposed.

Patch Information

The fix is delivered in WeGIA 3.2.16 via commit 0f2644bca2afbdfff21662c51a64679dfba8c2bd. The patch introduces three defenses: session-based permission checks through permissao(), input sanitization using filter_input(INPUT_POST, 'status', FILTER_SANITIZE_STRING), and output encoding via htmlspecialchars() on rendered values. See the GitHub Security Advisory GHSA-j3p8-xww6-wvqh for full advisory details.

Workarounds

If immediate patching is not feasible, restrict network access to adicionar_status_atendido.php to trusted IP ranges via web server or firewall rules.
Deploy a Content Security Policy (CSP) header disallowing inline scripts to limit the impact of injected payloads.
Configure a WAF to block requests where the status parameter contains HTML tags or JavaScript event handlers.

bash

# Example NGINX rule to block script tags in the status parameter
location /dao/adicionar_status_atendido.php {
    if ($request_body ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
}

# Example CSP header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';";