CVE-2025-62597: Wegia Wegia XSS Vulnerability

CVE-2025-62597 Overview

CVE-2025-62597 is a reflected cross-site scripting (XSS) vulnerability in WeGIA, an open source web manager for institutions targeting Portuguese language users. The flaw exists in the editar_info_pessoal.php endpoint and affects all versions prior to 3.5.1. Attackers can inject malicious scripts through the sql parameter of a GET request to /WeGIA/html/pessoa/editar_info_pessoal.php?sql=1. The maintainers patched the issue in version 3.5.1. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Successful exploitation lets an unauthenticated attacker execute arbitrary JavaScript in a victim's browser, enabling session theft, credential harvesting, and unauthorized actions in the WeGIA application context.

Affected Products

WeGIA versions prior to 3.5.1
The editar_info_pessoal.php endpoint under /WeGIA/html/pessoa/
Deployments processing untrusted values in the sql query parameter

Discovery Timeline

2025-10-21 - CVE-2025-62597 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62597

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the editar_info_pessoal.php script, which handles editing personal information for individuals stored in WeGIA. The endpoint accepts a sql GET parameter and reflects its value into the rendered HTML response without adequate output encoding or input validation. An attacker crafts a URL containing JavaScript payloads in the sql parameter and delivers it to a WeGIA user through phishing, chat messages, or embedded links. When the victim loads the URL, the payload executes in the browser under the WeGIA origin.

Because the vulnerable code path also called extract($_REQUEST), arbitrary request parameters were promoted to PHP variables, expanding the attack surface for variable injection beyond simple script reflection. The affected page requires no authentication challenge before reflecting attacker-controlled input, and the endpoint is served over the network to any client that can reach the WeGIA web server.

Root Cause

The root cause is the absence of output sanitization on user-controlled input processed by editar_info_pessoal.php. The legacy code used extract($_REQUEST) to unpack request parameters directly into the local scope and echoed variables into the HTML response. This pattern violates the least-privilege principle for input handling and enables injection of <script> tags or event handlers through the sql parameter.

Attack Vector

The attack vector is network-based and requires no privileges. An attacker crafts a URL such as /WeGIA/html/pessoa/editar_info_pessoal.php?sql=<payload> and lures an authenticated WeGIA user to click it. The reflected payload executes in the victim's session, allowing the attacker to steal session cookies, submit CSRF-authenticated requests, or manipulate the DOM to phish credentials.

php

// Patch excerpt from html/pessoa/editar_info_pessoal.php
// Source: https://github.com/LabRedesCefetRJ/WeGIA/commit/e41395fe6a7b4f428b1797a8d5b52e0e3dbbb3d9

<?php
-ini_set('display_errors',1);
-ini_set('display_startup_erros',1);
-error_reporting(E_ALL);
-extract($_REQUEST);
-session_start();
-if (!isset($_SESSION["usuario"])){
-    header("Location: ../../index.php");
+if (session_status() === PHP_SESSION_NONE) {
+    session_start();
 }

+if (!isset($_SESSION["usuario"])) {
+    header("Location: ../../index.php");
+    exit();
+} else {
+    session_regenerate_id();
+}

// Verifica Permissão do Usuário
require_once '../permissao/permissao.php';
permissao($_SESSION['id_pessoa'], 1, 3);

require_once "../../dao/Conexao.php";
-$pdo = Conexao::connect();
-$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+require_once dirname(__FILE__, 3) . DIRECTORY_SEPARATOR . 'classes' . DIRECTORY_SEPARATOR . 'Util.php';

extract($_POST);

The patch removes the unrestricted extract($_REQUEST) call, hardens session handling, regenerates the session identifier after authentication, and introduces the Util.php helper used to sanitize output. See the GitHub commit for full context.

Detection Methods for CVE-2025-62597

Indicators of Compromise

GET requests to /WeGIA/html/pessoa/editar_info_pessoal.php containing HTML or JavaScript metacharacters such as <script>, onerror=, or javascript: in the sql parameter
Referer headers pointing to external phishing domains that redirect to WeGIA endpoints
Web server access logs showing repeated probing of editar_info_pessoal.php?sql= with URL-encoded payloads

Detection Strategies

Deploy web application firewall rules that inspect the sql query parameter for script tags, event handlers, and encoded XSS payloads
Correlate WeGIA access logs against authenticated user sessions to detect anomalous URL patterns targeting the vulnerable endpoint
Compare deployed WeGIA source against the 3.5.1 release to identify unpatched instances still using extract($_REQUEST)

Monitoring Recommendations

Enable verbose HTTP access logging on the WeGIA web server and forward logs to a centralized analytics platform for query-time hunting
Alert on outbound requests from browsers loading WeGIA pages to unexpected domains, which may indicate cookie exfiltration
Track version metadata of WeGIA deployments and flag any instance older than 3.5.1

How to Mitigate CVE-2025-62597

Immediate Actions Required

Upgrade WeGIA to version 3.5.1 or later using the GitHub 3.5.1 release
Review web server logs for suspicious requests against editar_info_pessoal.php with unusual sql parameter values
Force session invalidation and password rotation for users who may have clicked crafted URLs

Patch Information

The fix is available in WeGIA 3.5.1. It removes the unsafe extract($_REQUEST) call, adds session hardening, and integrates a sanitization utility (Util.php). Refer to the GitHub Security Advisory GHSA-wqjv-fhc9-h7hm and the commit e41395f for details.

Workarounds

Restrict access to /WeGIA/html/pessoa/editar_info_pessoal.php at the reverse proxy layer until the upgrade is applied
Configure a WAF rule to block requests where the sql parameter contains <, >, ", or script
Enforce a strict Content-Security-Policy header on the WeGIA application to limit inline script execution

bash

# Example nginx WAF-style filter for the vulnerable endpoint
location /WeGIA/html/pessoa/editar_info_pessoal.php {
    if ($arg_sql ~* "(<|>|script|onerror|onload|javascript:)") {
        return 403;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'";
    proxy_pass http://wegia_backend;
}