CVE-2025-29782 Overview
CVE-2025-29782 is a stored Cross-Site Scripting (XSS) vulnerability in WeGIA, a web-based management application for charitable institutions. The flaw exists in the adicionar_tipo_docs_atendido.php endpoint in versions prior to 3.2.17. Attackers can inject malicious JavaScript into the tipo parameter, which the server persists and later serves to any user visiting the affected page. The issue is tracked as [CWE-79] and has been patched in WeGIA version 3.2.17.
Critical Impact
Persistent script injection through the tipo parameter enables session hijacking, credential theft, and unauthorized actions in the context of any user rendering the affected page.
Affected Products
- WeGIA application versions prior to 3.2.17
- Vulnerable endpoint: adicionar_tipo_docs_atendido.php
- Fixed release: WeGIA v3.2.17
Discovery Timeline
- 2025-03-14 - CVE-2025-29782 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-29782
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the WeGIA document type management workflow. The adicionar_tipo_docs_atendido.php endpoint accepts a tipo parameter without sufficient output encoding or input sanitization. Values submitted through this parameter are written to persistent storage and rendered back to users when the affected page loads.
Because the payload persists server-side, every user who accesses the document type interface executes the injected script under their own browser session. This differs from reflected XSS because no social engineering step is required after the payload is planted. An attacker who reaches the vulnerable endpoint once can affect every subsequent visitor.
WeGIA is deployed by charitable organizations that handle personally identifiable information about beneficiaries and staff. Successful exploitation exposes session cookies, authentication tokens, and sensitive form data rendered in the browser.
Root Cause
The root cause is improper neutralization of input during web page generation, classified as [CWE-79]. The application accepts the tipo parameter, stores it, and later includes it in HTML output without contextual escaping. HTML, JavaScript, and attribute contexts require distinct encoding, and the missing enforcement allows <script> tags and event handlers to execute.
Attack Vector
Exploitation requires network access to the WeGIA application and the ability to submit a request to adicionar_tipo_docs_atendido.php. The attacker supplies a crafted tipo value containing JavaScript. When a victim navigates to the page that renders stored document type entries, the browser executes the payload in the origin of the WeGIA deployment.
The vulnerability requires user interaction only to trigger the stored payload; injection itself does not depend on the victim's presence. Refer to the GitHub Security Advisory GHSA-5x5w-5c99-vr8h for additional technical detail.
Detection Methods for CVE-2025-29782
Indicators of Compromise
- HTTP POST requests to adicionar_tipo_docs_atendido.php where the tipo parameter contains HTML tags, <script> blocks, on* event handlers, or javascript: URIs.
- Database entries in the document type table containing angle brackets, encoded script fragments, or unexpected JavaScript keywords.
- Outbound browser requests from authenticated WeGIA users to unfamiliar domains shortly after loading document type pages, suggesting credential or session exfiltration.
Detection Strategies
- Inspect web server access logs for anomalous payloads targeting adicionar_tipo_docs_atendido.php, particularly URL-encoded <, >, and script sequences.
- Deploy a Web Application Firewall (WAF) rule set that flags XSS signatures on form submissions to WeGIA endpoints.
- Perform periodic content review of stored document type records to identify persisted markup that should not contain HTML.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture blocked inline script executions originating from WeGIA pages.
- Alert on session token use from geographically implausible sources following user access to document type screens.
- Monitor administrator and staff accounts for unexpected privilege changes or record modifications that could indicate script-driven abuse.
How to Mitigate CVE-2025-29782
Immediate Actions Required
- Upgrade WeGIA to version 3.2.17 or later, which contains the official patch. See the WeGIA v3.2.17 release notes.
- Audit the document type storage table and remove any records containing HTML or JavaScript payloads.
- Invalidate active sessions and force password resets for accounts that may have loaded the affected page while a payload was present.
Patch Information
The maintainers released WeGIA v3.2.17 on the LabRedesCefetRJ GitHub repository. The fix addresses the missing input handling on adicionar_tipo_docs_atendido.php. Full details are published in GitHub Security Advisory GHSA-5x5w-5c99-vr8h.
Workarounds
- Restrict access to adicionar_tipo_docs_atendido.php at the reverse proxy or WAF layer until the patch is applied.
- Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources for the WeGIA application.
- Limit the roles permitted to create or modify document type entries, reducing the population of accounts able to submit payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
