CVE-2025-62359: Wegia Web Manager Reflected XSS Vulnerability

CVE-2025-62359 Overview

CVE-2025-62359 is a Reflected Cross-Site Scripting (XSS) vulnerability in WeGIA, an open source web manager for institutions targeting Portuguese-language users. The flaw resides in the /pet/profile_pet.php endpoint, where the id_pet query parameter is reflected into the response without proper sanitization or output encoding. Attackers can craft a malicious URL that injects arbitrary JavaScript into an authenticated user's browser session. The vulnerability affects all WeGIA versions prior to 3.5.0 and is tracked under [CWE-79]. The maintainers released a patch in version 3.5.0.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, enabling session token theft, UI manipulation, and phishing against institutional users.

Affected Products

WeGIA versions prior to 3.5.0
Component: wegia:wegia
Vulnerable endpoint: /pet/profile_pet.php?id_pet=

Discovery Timeline

2025-10-13 - CVE-2025-62359 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62359

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw located in the profile_pet.php script under the /pet/ path of the WeGIA application. When a request is sent with a crafted id_pet parameter, the application reflects the parameter value directly into the rendered HTML response. The absence of contextual output encoding allows attacker-controlled input to break out of the intended data context and execute as JavaScript within the victim's browser.

Because the payload executes in the origin of the WeGIA application, an attacker can access document.cookie (where session cookies are not marked HttpOnly), perform actions on behalf of the authenticated user, or render fake login forms to harvest credentials. Exploitation requires the victim to click a crafted link while authenticated to a vulnerable WeGIA instance.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The id_pet parameter received via HTTP GET is emitted into HTML output without escaping characters such as <, >, ", and '. This allows raw script tags or event-handler attributes to be interpreted by the browser.

Attack Vector

Exploitation is performed over the network. An attacker crafts a URL containing a JavaScript payload in the id_pet parameter and delivers it to a target user via phishing, chat, or an untrusted web page. When the authenticated user follows the link, the WeGIA server reflects the payload and the browser executes it in the application's origin. Refer to the GitHub Security Advisory GHSA-68mw-h9q4-j34f for the maintainer's technical description.

The vulnerability manifests when the id_pet GET parameter is concatenated into HTML without encoding. No verified proof-of-concept code is published beyond the reference material linked in the advisory.

Detection Methods for CVE-2025-62359

Indicators of Compromise

Web server access logs containing requests to /pet/profile_pet.php with id_pet values that include <script>, onerror=, onload=, javascript:, or URL-encoded equivalents such as %3Cscript%3E.
Referer headers pointing to external or untrusted domains for requests targeting profile_pet.php.
Unexpected outbound requests from authenticated user browsers to attacker-controlled hosts shortly after visits to WeGIA.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the id_pet parameter for HTML tags, JavaScript event handlers, and encoded script payloads.
Enable server-side request logging with full query string capture and alert on anomalous character sequences in parameters historically containing only numeric identifiers.
Perform authenticated dynamic application security testing (DAST) scans against the /pet/profile_pet.php endpoint to confirm patch effectiveness.

Monitoring Recommendations

Aggregate WeGIA HTTP logs into a centralized SIEM and correlate suspicious id_pet requests with subsequent session activity from the same user.
Monitor browser-reported Content Security Policy (CSP) violation reports for inline script execution attempts.
Track authentication anomalies and session token reuse across geographies for accounts that visited crafted links.

How to Mitigate CVE-2025-62359

Immediate Actions Required

Upgrade WeGIA to version 3.5.0 or later, which contains the official fix delivered in commit 176733543c9b6762bef5ddec7c9c555f76fafa1d.
Review web server logs for prior exploitation attempts against /pet/profile_pet.php and rotate session credentials of any users who clicked suspicious links.
Communicate the risk to institutional users and advise caution with unsolicited WeGIA links.

Patch Information

The WeGIA maintainers released version 3.5.0 as the fixed release. Details are published in the GitHub Security Advisory GHSA-68mw-h9q4-j34f and tracked in GitHub Issue #257. Administrators should validate the deployed version after upgrade and confirm the endpoint no longer reflects unescaped input.

Workarounds

If immediate upgrade is not possible, place WeGIA behind a WAF that blocks HTML and JavaScript metacharacters in the id_pet parameter.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources to reduce impact of reflected payloads.
Set session cookies with the HttpOnly and SameSite=Strict attributes to limit token theft and cross-site delivery of malicious links.

bash

# Example nginx rule to block obvious XSS payloads in id_pet
if ($arg_id_pet ~* "(<|%3C)script|onerror=|onload=|javascript:") {
    return 403;
}