CVE-2025-30362 Overview
CVE-2025-30362 is a stored Cross-Site Scripting (XSS) vulnerability in WeGIA, an open-source web manager for charitable institutions. The flaw affects all versions prior to 3.2.8 and allows attackers to inject persistent malicious scripts into the application. When a user loads the compromised page, the script executes within their browser context. Because the payload is stored server-side, every user visiting the affected page is exposed. Version 3.2.8 fixes the issue.
Critical Impact
Attackers can persistently inject JavaScript that executes in every visitor's browser, enabling session theft, credential harvesting, and unauthorized actions performed as authenticated users.
Affected Products
- WeGIA versions prior to 3.2.8
- LabRedesCefetRJ WeGIA web manager
- Deployments serving charitable institution workflows
Discovery Timeline
- 2025-03-27 - CVE-2025-30362 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30362
Vulnerability Analysis
The vulnerability is a stored Cross-Site Scripting flaw classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation. WeGIA fails to properly sanitize user-supplied input before persisting it and rendering it back to browsers. An attacker submits crafted HTML or JavaScript through an affected input field. The application stores the payload in its backend datastore. When any user later loads the page displaying that data, the browser parses and executes the injected script under the origin of the WeGIA application.
Stored XSS carries broader impact than reflected XSS because a single injection affects every visitor to the compromised page. Attackers can hijack authenticated sessions, exfiltrate personal data belonging to donors and beneficiaries, or pivot to administrative accounts.
Root Cause
The root cause is missing or insufficient output encoding and input validation in WeGIA versions before 3.2.8. User-controlled data reaches the HTML response context without escaping of characters such as <, >, and ". The absence of a strict Content Security Policy allows inline scripts to execute freely.
Attack Vector
Exploitation occurs over the network and requires user interaction. An attacker with the ability to submit content to a vulnerable field injects a JavaScript payload. The payload persists in the WeGIA database. When a legitimate user, including administrators, loads the affected page, the script runs in their browser session. No authentication is required to submit the initial payload on affected endpoints, according to the advisory. Full technical details are available in the GitHub Security Advisory GHSA-fmcm-gp6j-xr87.
Detection Methods for CVE-2025-30362
Indicators of Compromise
- Unexpected <script> tags, event handler attributes (onerror, onload), or javascript: URIs stored in WeGIA database records.
- Outbound HTTP requests from user browsers to unfamiliar domains immediately after loading WeGIA pages.
- Anomalous session activity such as administrative actions from user accounts that normally lack those privileges.
Detection Strategies
- Review WeGIA application logs for POST requests containing encoded script fragments such as %3Cscript%3E or onerror=.
- Query the database for stored fields containing HTML control characters that should have been sanitized.
- Deploy a web application firewall rule that inspects submissions to WeGIA input endpoints for XSS payload signatures.
Monitoring Recommendations
- Enable Content Security Policy reporting to capture script execution violations in production.
- Monitor for unusual DOM modification patterns and outbound calls from browsers loading WeGIA pages.
- Alert on new administrative account creations or permission changes originating from the WeGIA application.
How to Mitigate CVE-2025-30362
Immediate Actions Required
- Upgrade WeGIA to version 3.2.8 or later, which contains the vendor fix.
- Audit stored records for injected script content and purge any malicious entries.
- Invalidate active user sessions and force password resets if injected payloads are found.
Patch Information
The WeGIA maintainers addressed the vulnerability in version 3.2.8. Details of the fix are published in the GitHub Security Advisory GHSA-fmcm-gp6j-xr87. Administrators should verify the installed version and apply the upgrade before restoring any previously suspended input functionality.
Workarounds
- Restrict access to input forms until the 3.2.8 upgrade is applied.
- Deploy a Content Security Policy header that disallows inline scripts and untrusted script sources.
- Place WeGIA behind a web application firewall with XSS filtering rules enabled.
# Example Content Security Policy header for WeGIA deployments
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
