CVE-2025-53526 Overview
CVE-2025-53526 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in WeGIA, an open-source web manager used by charitable institutions. The flaw resides in the novo_memorando.php endpoint, which fails to sanitize user-supplied memo content before persisting it. When an administrator or user later loads listar_memorandos_antigos.php to review historical memos, the injected script executes in the browser context. The vulnerability affects WeGIA versions prior to 3.4.3 and requires user interaction to trigger. WeGIA maintainers addressed the issue in release 3.4.3.
Critical Impact
An unauthenticated attacker can inject persistent JavaScript through the memo submission form, executing arbitrary script code in the browser of any user who subsequently views the memo list.
Affected Products
- WeGIA (vendor: wegia) versions prior to 3.4.3
- Component: novo_memorando.php (memo creation)
- Component: listar_memorandos_antigos.php (memo listing, execution sink)
Discovery Timeline
- 2025-07-07 - CVE-2025-53526 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-53526
Vulnerability Analysis
The vulnerability is a stored XSS issue in WeGIA's memorandum workflow. Input submitted through novo_memorando.php is written to the backing database without proper output encoding or input sanitization. When listar_memorandos_antigos.php renders previously submitted memos, the stored payload is emitted directly into the HTML response. Any browser loading the listing page parses and executes the attacker-controlled script.
Because the payload persists server-side, exploitation requires only one submission by an attacker with access to the memo creation form. Every subsequent viewer becomes a victim. The attack vector is network-based and requires user interaction to reach the vulnerable listing page.
Root Cause
The root cause is missing neutralization of input during web page generation, classified as CWE-79. The application concatenates user-supplied memo data directly into HTML output rather than applying context-aware encoding such as htmlspecialchars() on rendering, or a strict allow-list on submission.
Attack Vector
An attacker submits a memo through novo_memorando.php containing an HTML or JavaScript payload, for example a <script> tag or an event handler on an injected element. The payload is stored in the memo table. When a legitimate user navigates to listar_memorandos_antigos.php, the browser parses the unescaped content and runs the script under the origin of the WeGIA application. Attacker actions can include session token theft, forced actions via the victim's authenticated session, keylogging on the page, and redirection to phishing infrastructure. Refer to the GitHub Security Advisory GHSA-46fm-hx2r-69fg for advisory details.
Detection Methods for CVE-2025-53526
Indicators of Compromise
- Memo records in the WeGIA database containing HTML tags such as <script>, <img onerror=...>, <svg onload=...>, or javascript: URIs.
- HTTP POST requests to novo_memorando.php with parameter values containing angle brackets or JavaScript event handlers.
- Outbound requests from user browsers to unfamiliar domains shortly after loading listar_memorandos_antigos.php.
Detection Strategies
- Review web server access logs for POST requests to novo_memorando.php and correlate submitted parameters against XSS payload signatures.
- Query the memo storage table for stored values matching regular expressions targeting script tags and event-handler attributes.
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions on memo listing pages.
Monitoring Recommendations
- Enable Web Application Firewall (WAF) rules that flag XSS payloads submitted to WeGIA endpoints.
- Monitor session activity for unexpected privilege changes or account modifications following memo listing access.
- Alert on anomalous browser-originated requests to external domains from authenticated WeGIA sessions.
How to Mitigate CVE-2025-53526
Immediate Actions Required
- Upgrade WeGIA to version 3.4.3 or later, which contains the official fix.
- Audit the memo database and purge any records containing HTML or JavaScript payloads before returning the application to production.
- Rotate active session tokens and credentials for accounts that may have viewed malicious memos.
Patch Information
The fix is included in WeGIA 3.4.3. The corrective changes are published in commit f8cf5d0473334e6c28ea7f604da11ee2a7b419df and described in the GitHub Security Advisory GHSA-46fm-hx2r-69fg. Administrators should pull the tagged release and verify the version string after deployment.
Workarounds
- Restrict network access to the WeGIA application to trusted internal users until the upgrade is applied.
- Deploy a WAF rule that blocks requests to novo_memorando.php containing angle brackets or JavaScript event-handler attributes.
- Enforce a strict Content Security Policy that disallows inline scripts on WeGIA pages to limit exploitation impact.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
