CVE-2025-27418: Wegia Wegia Stored XSS Vulnerability

CVE-2025-27418 Overview

CVE-2025-27418 is a Stored Cross-Site Scripting (XSS) vulnerability in WeGIA, an open source Web Manager for Institutions targeted at Portuguese-language users. The flaw resides in the adicionar_tipo_atendido.php endpoint, which fails to sanitize the tipo parameter before persisting it to the database. Attackers can inject malicious JavaScript that executes in the browser of any user who subsequently loads the affected page. The vulnerability is tracked under [CWE-79] and is fixed in WeGIA version 3.2.16.

Critical Impact
Attackers can persist arbitrary JavaScript in institutional records, enabling session hijacking, credential theft, and unauthorized actions against authenticated WeGIA users.

Affected Products

WeGIA versions prior to 3.2.16
Component: dao/adicionar_tipo_atendido.php
Component: dao/exibir_tipo_atendido.php

Discovery Timeline

2025-03-03 - CVE-2025-27418 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27418

Vulnerability Analysis

The vulnerability is a stored (persistent) XSS in the WeGIA institutional management application. The adicionar_tipo_atendido.php endpoint accepts a tipo POST parameter used to register a new type of attended person (atendido_tipo). The unpatched code trims the value and writes it directly to the database without input filtering or output encoding.

When the sibling endpoint exibir_tipo_atendido.php later serializes these rows into JSON, the raw descricao field is emitted without HTML escaping. Any frontend that renders this JSON as HTML executes the attacker-supplied payload in the victim's browser context. Because the payload is stored server-side, exploitation is triggered automatically whenever an authorized user views the affected view.

Root Cause

Two defects combine to produce the vulnerability. First, adicionar_tipo_atendido.php performs no sanitization on $_POST["tipo"] before persistence. Second, exibir_tipo_atendido.php does not apply htmlspecialchars() to the descricao column when constructing the JSON response. The endpoint also lacks a session check and permission enforcement, allowing unauthenticated writes to the atendido_tipo table.

Attack Vector

Exploitation requires a network-reachable WeGIA instance and a user who later views the affected page. An attacker submits a POST request to adicionar_tipo_atendido.php with a JavaScript payload in the tipo field. The payload persists and executes on each subsequent page render.

php

// Patched code in dao/adicionar_tipo_atendido.php
// Source: https://github.com/LabRedesCefetRJ/WeGIA/commit/e2f258cc8fed8b7e5850114ce6e74bd9ba4f397f
<?php
session_start();
require_once 'Conexao.php';

// verificar permissão
require_once '../html/permissao/permissao.php';
permissao($_SESSION['id_pessoa'], 12, 3);

$descricao = trim(filter_input(INPUT_POST, 'tipo', FILTER_SANITIZE_STRING));

if(!$descricao || empty($descricao)){
    http_response_code(400);
    echo json_encode(['erro' => 'Erro, a descrição de um novo tipo não poder ser vazia.']);
    exit();
}

The companion fix in dao/exibir_tipo_atendido.php applies output encoding when returning stored values:

php

// Patched code in dao/exibir_tipo_atendido.php
// Source: https://github.com/LabRedesCefetRJ/WeGIA/commit/e2f258cc8fed8b7e5850114ce6e74bd9ba4f397f
$resultado[] = array(
    'idatendido_tipo' => $row['idatendido_tipo'],
    'descricao'       => htmlspecialchars($row['descricao'])
);

Detection Methods for CVE-2025-27418

Indicators of Compromise

POST requests to /dao/adicionar_tipo_atendido.php containing <script>, onerror=, onload=, or javascript: substrings in the tipo parameter.
Rows in the atendido_tipo database table where descricao contains HTML tags or JavaScript event handlers.
Unexpected outbound requests from authenticated WeGIA user sessions to attacker-controlled domains.

Detection Strategies

Query the atendido_tipo table for descricao values matching the regular expression <[^>]+> or containing common XSS keywords such as alert(, document.cookie, and fetch(.
Enable web server access logging and search for POST bodies to adicionar_tipo_atendido.php that include URL-encoded angle brackets (%3C, %3E).
Deploy a Content Security Policy (CSP) report-only header and monitor violation reports for inline script executions on pages rendering atendido_tipo data.

Monitoring Recommendations

Alert on any request to WeGIA dao/ endpoints originating from unauthenticated sessions.
Track HTTP 400 responses from adicionar_tipo_atendido.php, which indicate the patched validation logic is rejecting empty or malformed submissions.
Review WeGIA application logs for administrative page loads that coincide with anomalous browser-side network activity.

How to Mitigate CVE-2025-27418

Immediate Actions Required

Upgrade WeGIA to version 3.2.16 or later, which contains the sanitization and permission fixes.
Audit the atendido_tipo table and remove any rows whose descricao field contains HTML or script content.
Restrict network access to WeGIA administrative endpoints until patching is complete.

Patch Information

The fix is delivered in WeGIA 3.2.16 via commit e2f258cc8fed8b7e5850114ce6e74bd9ba4f397f. The patch introduces filter_input(INPUT_POST, 'tipo', FILTER_SANITIZE_STRING) on input, adds a session-based permission check via permissao($_SESSION['id_pessoa'], 12, 3), and applies htmlspecialchars() on output in exibir_tipo_atendido.php. See the GitHub Security Advisory GHSA-ffcg-qr75-98mg and the upstream commit for full details.

Workarounds

Place WeGIA behind a web application firewall (WAF) rule that blocks HTML tags and JavaScript event handlers in the tipo POST parameter.
Set a strict Content Security Policy that disallows inline scripts (script-src 'self') on all WeGIA pages.
Limit access to /dao/adicionar_tipo_atendido.php by IP allowlist at the reverse proxy until the upgrade is deployed.

bash

# Example nginx location rule to block script payloads in the tipo parameter
location = /dao/adicionar_tipo_atendido.php {
    if ($request_method = POST) {
        set $block 0;
        if ($request_body ~* "(<script|onerror=|onload=|javascript:)") { set $block 1; }
        if ($block = 1) { return 403; }
    }
    proxy_pass http://wegia_backend;
}