CVE-2025-27420: Wegia Wegia Stored XSS Vulnerability

CVE-2025-27420 Overview

CVE-2025-27420 is a Stored Cross-Site Scripting (XSS) vulnerability in WeGIA, an open source web manager for institutions targeted at Portuguese language users. The flaw resides in the atendido_parentesco_adicionar.php endpoint, which fails to sanitize the descricao parameter before persisting it. Attackers can inject malicious JavaScript that is stored server-side and executed automatically when other users visit the affected page. The vulnerability is classified as [CWE-79] and was fixed in WeGIA version 3.2.16.

Critical Impact

Authenticated attackers can persistently inject scripts that execute in the browser of any user viewing the parentesco records, enabling session hijacking, credential theft, or unauthorized actions in the WeGIA management interface.

Affected Products

• WeGIA (LabRedesCefetRJ) versions prior to 3.2.16
• The html/atendido/atendido_parentesco_adicionar.php endpoint
• The html/atendido/Profile_Atendido.php rendering component

Discovery Timeline

• 2025-03-03 - CVE-2025-27420 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27420

Vulnerability Analysis

The vulnerability exists in the WeGIA parentesco (kinship) management workflow. The atendido_parentesco_adicionar.php endpoint accepts a descricao POST parameter and writes it directly to the atendido_parentesco database table without output-encoding or input sanitization. When Profile_Atendido.php later renders the parentesco column inside an HTML <option> element, the raw stored value is echoed into the response.

Because the payload persists in the database, every user who loads the profile page triggers script execution. This enables session token theft, forced actions via the authenticated victim, and pivoting to administrative accounts. The vulnerability requires user interaction (UI:A) to trigger execution but no elevated privileges to plant the payload.

Root Cause

The root cause is missing output encoding on database-sourced content combined with missing input filtering on user submissions. The original code invoked echo on $item["parentesco"] directly, and the write path used $_POST["descricao"] with only a trim() call.

Attack Vector

An attacker with access to submit new parentesco entries posts a crafted descricao payload containing HTML or JavaScript. The payload is stored and later rendered inside a <select> on the atendido profile page, executing in the browser context of any viewer.

// Patched read path in html/atendido/Profile_Atendido.php
<?php
foreach ($pdo->query("SELECT * FROM atendido_parentesco ORDER BY parentesco ASC;")->fetchAll(PDO::FETCH_ASSOC) as $item) {
  echo ("
-    <option value='" . $item["idatendido_parentesco"] . "' >" . $item["parentesco"] . "</option>
+    <option value='" . $item["idatendido_parentesco"] . "' >" . htmlspecialchars($item["parentesco"]) . "</option>
  ");
}
?>
// Source: https://github.com/LabRedesCefetRJ/WeGIA/commit/add78bb177cbb29477ff2121b533651a9d673918

Detection Methods for CVE-2025-27420

Indicators of Compromise

• Entries in the atendido_parentesco table whose parentesco column contains <script>, onerror=, onload=, or javascript: substrings.
• HTTP POST requests to /html/atendido/atendido_parentesco_adicionar.php with a descricao parameter containing HTML tags or event handlers.
• Outbound requests from browsers viewing atendido profiles to attacker-controlled domains not otherwise referenced by WeGIA.

Detection Strategies

• Query the WeGIA database directly for stored payloads: SELECT * FROM atendido_parentesco WHERE parentesco REGEXP '<|javascript:|on[a-z]+=';.
• Review webserver access logs for POST bodies to the vulnerable endpoint that include suspicious characters such as <, >, or %3C.
• Deploy a Content Security Policy (CSP) report-only header to surface script executions that violate the expected policy.

Monitoring Recommendations

• Enable and centralize PHP and webserver access logs for the /html/atendido/ path, ingesting them into a SIEM for correlation.
• Alert on repeated 400 responses from atendido_parentesco_adicionar.php, which indicate probing attempts against the sanitized endpoint.
• Monitor authenticated session activity for anomalous administrative actions following visits to atendido profile pages.

How to Mitigate CVE-2025-27420

Immediate Actions Required

• Upgrade WeGIA to version 3.2.16 or later, which introduces htmlspecialchars output encoding and filter_input sanitization.
• Audit the atendido_parentesco table for previously injected payloads and purge or re-encode any stored HTML.
• Force session invalidation for users who may have viewed compromised profile pages, requiring re-authentication.

Patch Information

The fix is delivered in commit add78bb and documented in GHSA-x3wr-75qx-55cw. The patch applies htmlspecialchars() to the parentesco field on render and replaces raw $_POST access with filter_input(INPUT_POST, 'descricao', FILTER_SANITIZE_STRING) on write.

Workarounds

• Restrict access to /html/atendido/atendido_parentesco_adicionar.php at the webserver level to trusted administrative users only until the patch is applied.
• Deploy a Web Application Firewall (WAF) rule that blocks POST requests containing HTML tags or event-handler attributes in the descricao parameter.
• Add a strict Content Security Policy that disallows inline scripts (script-src 'self') to limit the impact of stored payloads.

# Example WAF rule (ModSecurity) blocking script payloads in descricao
SecRule ARGS:descricao "@rx (?i)(<script|javascript:|on[a-z]+\s*=)" \
  "id:1002741,phase:2,deny,status:400,log,msg:'CVE-2025-27420 WeGIA XSS attempt'"