CVE-2025-27499: Wegia Wegia Stored XSS Vulnerability

CVE-2025-27499 Overview

CVE-2025-27499 is a stored Cross-Site Scripting (XSS) vulnerability in WeGIA, an open-source web manager for institutions targeted at Portuguese language users. The flaw resides in the processa_edicao_socio.php endpoint, which accepts unsanitized input through the socio_nome parameter. Attackers can inject malicious JavaScript that is persisted on the server and executed in every user's browser when the affected page loads. The vulnerability is tracked as [CWE-79] and is fixed in WeGIA version 3.2.10.

Critical Impact
Persistent script injection allows attackers to hijack sessions, steal credentials, and perform actions on behalf of authenticated institutional users.

Affected Products

WeGIA versions prior to 3.2.10
processa_edicao_socio.php endpoint (member edit processing)
Deployments accepting the socio_nome parameter without sanitization

Discovery Timeline

2025-03-03 - CVE-2025-27499 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27499

Vulnerability Analysis

The vulnerability exists in html/socio/sistema/processa_edicao_socio.php, which processes updates to institutional member (socio) records. The endpoint reads user-supplied values, including socio_nome, and stores them directly in the database without output encoding or input sanitization. When any user subsequently views a page rendering that stored value, the browser executes the injected script in the context of the WeGIA application.

Because WeGIA manages institutional member data, the stored payload executes for staff and administrators, expanding blast radius beyond a single victim. The stored nature of the injection removes the need for social engineering after initial submission.

Root Cause

The root cause is missing input sanitization prior to persisting form fields to the database. Values submitted through the member edit form are passed to prepared statements for SQL safety, but no sanitizing filter such as FILTER_SANITIZE_STRING is applied to strip or encode HTML and script markup before storage or rendering.

Attack Vector

An unauthenticated or low-privileged attacker submits a crafted socio_nome value containing JavaScript through the member edit workflow. The payload persists in the database. When an authenticated user, including administrators, views the affected member record, the browser executes the attacker's script, enabling cookie theft, session hijacking, or forced actions within the application.

php

// Source: https://github.com/LabRedesCefetRJ/WeGIA/commit/1ac0d0701ad93103482374e8092ad1a5ab15d3fc
// Patch applied in html/socio/sistema/processa_edicao_socio.php
$stmt = mysqli_prepare($conexao, $sqlUpdatePessoa);

//sanitização das entradas
$cpf_cnpj = filter_var($cpf_cnpj, FILTER_SANITIZE_STRING);
$socio_nome = filter_var($socio_nome, FILTER_SANITIZE_STRING);
$telefone = filter_var($telefone, FILTER_SANITIZE_STRING);
$cep = filter_var($cep, FILTER_SANITIZE_STRING);
$estado = filter_var($estado, FILTER_SANITIZE_STRING);
$cidade = filter_var($cidade, FILTER_SANITIZE_STRING);
$bairro = filter_var($bairro, FILTER_SANITIZE_STRING);
$rua = filter_var($rua, FILTER_SANITIZE_STRING);
$numero = filter_var($numero, FILTER_SANITIZE_STRING);
$complemento = filter_var($complemento, FILTER_SANITIZE_STRING);
$id_pessoa = filter_var($id_pessoa, FILTER_SANITIZE_NUMBER_INT);

The patch introduces filter_var sanitization on each user-controlled field before the values reach the prepared statement bindings. See the GitHub Commit Details for the full diff.

Detection Methods for CVE-2025-27499

Indicators of Compromise

Member records containing HTML tags such as <script>, <img onerror=>, or <svg onload=> in the socio_nome field or related member fields.
HTTP POST requests to processa_edicao_socio.php with payloads containing angle brackets or JavaScript event handlers in the socio_nome parameter.
Unexpected outbound requests from staff browsers to attacker-controlled domains shortly after accessing member profile pages.

Detection Strategies

Review web server logs for POST requests to processa_edicao_socio.php and flag socio_nome values containing <, >, javascript:, or common XSS keywords.
Query the WeGIA database for member records whose stored name fields contain HTML or script tokens and treat matches as suspect.
Deploy a Web Application Firewall (WAF) rule that inspects submitted form fields for XSS signatures on the member edit workflow.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script executions on WeGIA pages.
Monitor administrator session activity for anomalous requests originating from authenticated sessions immediately after viewing member records.
Alert on new admin account creation or privilege changes following access to potentially tainted member profile pages.

How to Mitigate CVE-2025-27499

Immediate Actions Required

Upgrade WeGIA to version 3.2.10 or later, which applies input sanitization in processa_edicao_socio.php.
Audit the socio and related tables for stored HTML or JavaScript content and remediate any injected payloads.
Reset session tokens and require re-authentication for administrative users if injected content is discovered.

Patch Information

The fix is committed in GitHub Commit 1ac0d07 and documented in GitHub Security Advisory GHSA-v248-mr5r-87pf. The patch applies FILTER_SANITIZE_STRING to string inputs and FILTER_SANITIZE_NUMBER_INT to id_pessoa before database binding.

Workarounds

Restrict access to the member edit workflow to trusted administrators via network-level controls until the patch is applied.
Deploy a WAF rule blocking angle brackets and script keywords in socio_nome and related fields on processa_edicao_socio.php.
Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of any stored payloads.

bash

# Example CSP header to mitigate stored XSS execution in WeGIA responses
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';";