CVE-2025-53525: Wegia Wegia XSS Vulnerability

CVE-2025-53525 Overview

CVE-2025-53525 is a Reflected Cross-Site Scripting (XSS) vulnerability in WeGIA, an open-source web manager for charitable institutions. The flaw resides in the profile_familiar.php endpoint, where the id_dependente GET parameter is reflected back to the user without proper sanitization. Attackers can craft malicious URLs that execute arbitrary JavaScript in a victim's browser when the link is opened. The issue is tracked under [CWE-79] and is fixed in WeGIA version 3.4.3. User interaction is required to trigger the payload, and the impact is limited to the browser context.

Critical Impact
Successful exploitation enables script execution in the victim's browser session, potentially leading to UI manipulation or targeted phishing against WeGIA users.

Affected Products

WeGIA versions prior to 3.4.3
html/atendido/profile_familiar.php endpoint
Deployments exposing WeGIA to untrusted network users

Discovery Timeline

2025-07-07 - CVE-2025-53525 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53525

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the profile_familiar.php script of the WeGIA application. The endpoint accepts an id_dependente query parameter and reflects its value into the rendered HTML response without proper output encoding or input filtering. An attacker who convinces an authenticated or unauthenticated user to click a crafted link can execute arbitrary JavaScript in that user's browser. The executed script runs in the origin of the WeGIA deployment. Because WeGIA serves charitable institutions, the primary abuse scenarios involve social engineering of staff or beneficiaries interacting with the platform.

Root Cause

The root cause is missing input validation on the id_dependente GET parameter. The pre-patch code cast the value using (int), but the raw value was still consumed elsewhere in the rendered page, allowing script content to reach the DOM. The fix replaces the cast with filter_input(INPUT_GET, 'id_dependente', FILTER_SANITIZE_NUMBER_INT), ensuring only numeric content is retained before use.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL pointing to the vulnerable endpoint with a JavaScript payload embedded in id_dependente, then delivers it via email, chat, or a malicious page. When the victim opens the link in a browser session with access to the WeGIA instance, the payload executes in that origin.

php

// Security patch in html/atendido/profile_familiar.php
 require_once "../geral/msg.php";

-$id_dependente = isset($_GET['id_dependente']) ? (int) $_GET['id_dependente'] : null;
+$id_dependente = filter_input(INPUT_GET, 'id_dependente', FILTER_SANITIZE_NUMBER_INT);

 if ($id_dependente) {
     $stmt = $pdo->prepare("...");

Source: WeGIA commit 45695ed

The patch enforces numeric-only input on the id_dependente parameter, removing any script content before it can be reflected into the response.

Detection Methods for CVE-2025-53525

Indicators of Compromise

Web server access logs containing profile_familiar.php?id_dependente= with URL-encoded <script>, onerror=, or javascript: payloads
Unusual referrers or short-lived, one-time links delivered via email that target the WeGIA atendido module
Outbound requests from browser sessions to attacker-controlled domains shortly after visits to profile_familiar.php

Detection Strategies

Deploy web application firewall (WAF) rules that block reflected XSS payload patterns on the id_dependente query parameter
Search HTTP logs for non-numeric values submitted to id_dependente, since the fixed code accepts only integers
Correlate WeGIA access logs with browser telemetry to identify sessions where suspicious URLs were opened

Monitoring Recommendations

Monitor the WeGIA application version deployed in production and alert when running builds prior to 3.4.3
Enable Content Security Policy (CSP) violation reporting to surface unexpected inline script execution
Review authentication events following suspected XSS delivery to detect session or credential abuse

How to Mitigate CVE-2025-53525

Immediate Actions Required

Upgrade WeGIA to version 3.4.3 or later, which contains the fix for profile_familiar.php
Audit exposed WeGIA instances and restrict access to trusted networks where feasible
Notify staff and users to avoid clicking untrusted links referencing WeGIA endpoints until patched

Patch Information

The vendor released the fix in commit 45695ed and published GitHub Security Advisory GHSA-982x-v58q-6qpj. The patch replaces the vulnerable input handling in html/atendido/profile_familiar.php with filter_input using FILTER_SANITIZE_NUMBER_INT. Administrators should apply version 3.4.3 from the official WeGIA repository.

Workarounds

Apply a WAF rule that rejects non-numeric values in the id_dependente parameter for profile_familiar.php
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources
Restrict access to the atendido module via network ACLs or reverse proxy authentication until the patch is applied

bash

# Example nginx rule to enforce numeric id_dependente
location ~ /html/atendido/profile_familiar\.php$ {
    if ($arg_id_dependente !~ "^[0-9]+$") {
        return 400;
    }
}