CVE-2025-62358: Wegia Wegia Reflected XSS Vulnerability

CVE-2025-62358 Overview

WeGIA is an open source web manager for institutions with a focus on Portuguese language users. CVE-2025-62358 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the log parameter in configuracao_geral.php. Attackers can craft malicious URLs that inject arbitrary JavaScript into the victim's browser session when the link is visited. The issue affects WeGIA versions prior to 3.5.1 and is resolved in release 3.5.1.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, enabling session data theft, credential harvesting, and unauthorized actions performed as the authenticated user.

Affected Products

WeGIA (wegia/wegia) versions prior to 3.5.1
The html/configuracao/configuracao_geral.php component
Institutional deployments of WeGIA exposing the configuration interface

Discovery Timeline

2025-10-13 - CVE-2025-62358 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62358

Vulnerability Analysis

The vulnerability resides in html/configuracao/configuracao_geral.php, part of the WeGIA administrative configuration interface. The log request parameter is reflected back into the rendered HTML response without adequate sanitization or output encoding. An attacker who tricks an authenticated user into visiting a crafted URL can inject arbitrary JavaScript that executes in the context of the WeGIA application origin.

Because the reflection occurs within an authenticated administrative page, an attacker can leverage the injected script to read session tokens, invoke privileged endpoints, or modify institutional data on behalf of the victim. The scope change reflected in the CVSS vector indicates that the injected script can affect resources beyond the vulnerable component itself.

Root Cause

The underlying weakness is improper neutralization of user-supplied input during web page generation [CWE-79]. The application accepts the log parameter from the request and emits it into the HTML output without contextual escaping, allowing script tags or event handlers to break out of the intended data context.

Attack Vector

Exploitation requires user interaction. The attacker distributes a malicious link — through phishing email, chat, or a compromised page — targeting an authenticated WeGIA user. When the victim loads the URL, the injected payload in the log parameter is reflected into the response and executed by the browser.

php

// Patch context in html/configuracao/configuracao_geral.php
 if(!isset($_SESSION['usuario'])){
 	header ("Location: ../../index.php");
 }

 // Verifica Permissão do Usuário
 require_once '../permissao/permissao.php';

Source: GitHub commit eddb9b1. The upstream commit sanitizes and validates handling of parameters reflected by configuracao_geral.php, eliminating the injection sink.

Detection Methods for CVE-2025-62358

Indicators of Compromise

HTTP GET requests to configuracao_geral.php containing <script>, javascript:, onerror=, or URL-encoded equivalents in the log parameter
Referer headers pointing to external domains for requests hitting /html/configuracao/configuracao_geral.php
Web server access logs showing abnormally long or encoded log parameter values

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag reflected script fragments in query strings targeting the WeGIA configuration endpoints
Perform static analysis of the WeGIA codebase for unescaped echo/print of $_GET and $_POST values, particularly in html/configuracao/
Monitor browser Content Security Policy (CSP) violation reports for inline script execution originating from configuration pages

Monitoring Recommendations

Centralize WeGIA web server and PHP error logs for parameter-based anomaly detection
Alert on outbound requests from browser sessions that immediately follow visits to configuracao_geral.php with suspicious query strings
Track authenticated admin session activity for unexpected privileged API calls that could indicate script-driven abuse

How to Mitigate CVE-2025-62358

Immediate Actions Required

Upgrade WeGIA to version 3.5.1 or later, which contains the official fix
Audit web server logs for prior requests to configuracao_geral.php containing script payloads in the log parameter
Force re-authentication of administrative sessions after upgrading to invalidate any tokens potentially exposed to injected scripts

Patch Information

The maintainers addressed the issue in commit eddb9b1 and released the fix in version 3.5.1. Details are documented in the GitHub Security Advisory GHSA-g6hr-2rhx-f8q4.

Workarounds

Restrict network access to the WeGIA administrative interface via IP allowlisting or VPN until patching is complete
Deploy WAF rules to block requests containing HTML or JavaScript metacharacters in the log parameter of configuracao_geral.php
Enforce a strict Content Security Policy that disallows inline script execution to reduce reflected XSS impact

bash

# Example WAF rule (ModSecurity) blocking script payloads in the log parameter
SecRule ARGS:log "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1062358,phase:2,deny,status:403,log,msg:'CVE-2025-62358 WeGIA reflected XSS attempt'"