CVE-2025-62178: WeGIA XSS Vulnerability

CVE-2025-62178 Overview

CVE-2025-62178 is a Reflected Cross-Site Scripting (XSS) vulnerability in WeGIA, an open source Web Manager for Institutions targeting Portuguese-language users. The flaw exists in the /html/atendido/cadastro_atendido_parestesco_pessoa_nova.php endpoint, where the idatendido GET parameter is echoed into HTML output without sanitization. Attackers can craft a malicious URL that executes arbitrary JavaScript in the victim's browser session. The issue affects all WeGIA versions prior to 3.5.1 and is tracked under [CWE-79]. The vendor released version 3.5.1 with a fix that applies htmlspecialchars() to the reflected input.

Critical Impact
Authenticated attackers can hijack sessions, perform actions on behalf of users, or steal sensitive institutional data by luring a WeGIA user into clicking a crafted link.

Affected Products

WeGIA versions prior to 3.5.1
Endpoint: /html/atendido/cadastro_atendido_parentesco_pessoa_nova.php
Parameter: idatendido

Discovery Timeline

2025-10-13 - CVE-2025-62178 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62178

Vulnerability Analysis

The vulnerability is a classic Reflected XSS in a PHP endpoint responsible for registering family relationships (parentesco) for a person (atendido). The application reads the idatendido value from $_GET and embeds it directly into an <input type="hidden"> element inside the rendered HTML. Because the value is written into the DOM without HTML entity encoding, an attacker can break out of the attribute context and inject arbitrary markup or script. Successful exploitation requires an authenticated user (PR:L) to click a crafted link (UI:R), and the scope change (S:C) reflects that injected script executes in the victim's browsing context and can affect resources beyond the vulnerable component.

Root Cause

The root cause is missing output encoding on user-controlled input. The vulnerable code writes $_GET['idatendido'] directly into an HTML attribute value using PHP short-echo syntax. No filter, cast, or encoding function is applied before the value reaches the browser, violating standard defensive practices for HTML attribute contexts.

Attack Vector

An attacker crafts a URL to the vulnerable endpoint containing a payload in the idatendido parameter that closes the value="" attribute and injects a script or event handler. The attacker delivers this URL to an authenticated WeGIA user through phishing, chat, or a third-party site. When the victim visits the link, the injected JavaScript executes in the context of the WeGIA origin, enabling session token theft, CSRF-like actions, or credential harvesting.

php

// Vulnerable code (prior to 3.5.1)
<input type="hidden" name="idatendido" value="<?= $_GET['idatendido']; ?>" readonly>

// Patched code in 3.5.1
<input type="hidden" name="idatendido" value="<?= htmlspecialchars($_GET['idatendido']); ?>" readonly>

Source: GitHub commit e39390f

Detection Methods for CVE-2025-62178

Indicators of Compromise

Requests to /html/atendido/cadastro_atendido_parentesco_pessoa_nova.php where the idatendido parameter contains characters such as <, >, ", ', or the strings script, onerror, onload, or javascript:.
Unusually long or URL-encoded idatendido values (for example %3Cscript%3E) in web server or reverse proxy access logs.
Referer headers pointing to untrusted external domains preceding requests to the vulnerable endpoint.

Detection Strategies

Deploy a web application firewall rule that inspects the idatendido query parameter for HTML metacharacters and common XSS payload patterns.
Enable Content Security Policy (CSP) reporting to capture script-src violations originating from WeGIA pages.
Review historical access logs for prior exploitation attempts against the vulnerable path.

Monitoring Recommendations

Alert on HTTP 200 responses to the vulnerable endpoint that contain reflected parameter values with < or > characters in the response body.
Correlate anomalous session activity (new IP, changed user-agent, rapid privilege actions) with recent requests to the vulnerable endpoint.
Monitor outbound requests from WeGIA users' browsers to domains not associated with the institution.

How to Mitigate CVE-2025-62178

Immediate Actions Required

Upgrade WeGIA to version 3.5.1 or later, which applies htmlspecialchars() to the vulnerable parameter.
Invalidate active user sessions after upgrading to force re-authentication.
Communicate to WeGIA users to avoid clicking untrusted links referencing the application.

Patch Information

The fix is delivered in WeGIA 3.5.1 via commit e39390f. The patch wraps $_GET['idatendido'] in htmlspecialchars() before rendering it into the hidden input. Full details are published in GitHub Security Advisory GHSA-fj32-779r-28qv and tracked in GitHub Issue #1181.

Workarounds

If immediate patching is not possible, deploy a WAF rule that blocks requests to /html/atendido/cadastro_atendido_parentesco_pessoa_nova.php when the idatendido parameter contains non-numeric characters.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script-src to trusted origins.
Restrict access to the WeGIA application to a trusted network segment or VPN until the upgrade is deployed.

bash

# Example ModSecurity rule to block non-numeric idatendido values
SecRule ARGS:idatendido "!@rx ^[0-9]+$" \
  "id:1006218,phase:2,deny,status:400,\
   msg:'CVE-2025-62178 WeGIA XSS attempt in idatendido'"