CVE-2025-62598: Wegia Wegia Reflected XSS Vulnerability

CVE-2025-62598 Overview

CVE-2025-62598 is a reflected cross-site scripting (XSS) vulnerability in WeGIA, an open source web manager for institutions targeted at Portuguese-language users. The flaw resides in the editar_info_pessoal.php endpoint and affects all versions prior to 3.5.1. An attacker can inject malicious JavaScript through the action parameter of a crafted GET /WeGIA/html/pessoa/editar_info_pessoal.php?action=1 request. When a victim visits the attacker-crafted URL, the injected script executes in the browser session under the WeGIA origin. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). The maintainers patched the issue in WeGIA release 3.5.1.

Critical Impact
Attackers can execute arbitrary JavaScript in an authenticated user's browser, enabling session theft, credential harvesting, and unauthorized actions against the WeGIA institutional management interface.

Affected Products

WeGIA (wegia:wegia) versions prior to 3.5.1
Endpoint: /WeGIA/html/pessoa/editar_info_pessoal.php
Deployments serving Portuguese-language institutional workflows

Discovery Timeline

2025-10-21 - CVE-2025-62598 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62598

Vulnerability Analysis

The vulnerability exists in the personal information editing workflow of WeGIA. The editar_info_pessoal.php script reflects the value of the action query-string parameter into the rendered HTML response without proper output encoding or input sanitization. Because the reflected content is placed directly into the DOM, an attacker can supply JavaScript payloads that the browser then parses and executes.

Exploitation requires only that a victim load a specially crafted URL while authenticated to WeGIA. Once the payload fires, the attacker gains the ability to read session cookies, submit authenticated requests on behalf of the user, exfiltrate data displayed by the interface, and pivot toward account takeover of privileged staff accounts. In institutional deployments handling personal records, this exposes sensitive beneficiary and employee data.

Root Cause

The root cause is missing neutralization of user-controlled input before it is echoed into the HTTP response. The action GET parameter is trusted by editar_info_pessoal.php and injected into the page without applying context-aware escaping such as htmlspecialchars() with ENT_QUOTES or a templating engine that auto-escapes untrusted values.

Attack Vector

Attack delivery is network-based and requires user interaction, typically via a phishing link, malicious referrer, or a hostile page that redirects the victim to the crafted WeGIA URL. No authentication or elevated privileges are required to craft the payload, though the impact scales with the privileges of the victim who follows the link. The vulnerability is reflected rather than stored, so each exploitation event depends on delivering the payload to a specific user session.

The injected script executes under the WeGIA origin, giving the attacker access to any data or functionality available to the victim inside the application. Detailed reproduction steps are documented in the GitHub Security Advisory GHSA-jmm7-rr7w-f223.

Detection Methods for CVE-2025-62598

Indicators of Compromise

HTTP requests to /WeGIA/html/pessoa/editar_info_pessoal.php where the action parameter contains characters such as <, >, ", ', or strings like script, onerror, onload, javascript:.
Unusually long or URL-encoded values in the action query parameter that decode to HTML or JavaScript syntax.
Web server access logs showing referrers from unrelated external domains linking directly to editar_info_pessoal.php.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag XSS patterns in query parameters targeting WeGIA endpoints.
Run authenticated dynamic application security testing (DAST) against editar_info_pessoal.php with fuzzed action values to confirm output encoding.
Correlate outbound browser telemetry with WeGIA sessions to spot script executions that contact untrusted domains after visiting the vulnerable URL.

Monitoring Recommendations

Enable verbose HTTP request logging on the WeGIA web server and retain logs for at least 90 days for incident review.
Monitor for spikes in 200 responses to editar_info_pessoal.php originating from external referrers or unauthenticated sessions.
Alert on any Content Security Policy (CSP) violation reports pointing to inline script execution on WeGIA pages.

How to Mitigate CVE-2025-62598

Immediate Actions Required

Upgrade WeGIA to version 3.5.1 or later, which contains the vendor fix for the reflected XSS in editar_info_pessoal.php.
Invalidate active WeGIA sessions and force re-authentication after upgrading to remove any hijacked tokens.
Review web server access logs for prior exploitation attempts against the vulnerable endpoint.

Patch Information

The maintainers released the fix in WeGIA 3.5.1. Administrators should deploy the patched release from the official repository and verify the version string after upgrade. Additional context on the fix is available in GitHub Security Advisory GHSA-jmm7-rr7w-f223.

Workarounds

Restrict access to /WeGIA/html/pessoa/editar_info_pessoal.php at the reverse proxy or WAF layer until the upgrade is complete.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources to reduce the impact of reflected payloads.
Configure session cookies with the HttpOnly and SameSite=Strict attributes to limit token theft through injected JavaScript.

bash

# Configuration example
# Verify WeGIA version and pull the patched release
git fetch --tags
git checkout 3.5.1

# Example nginx rule to block obvious XSS payloads on the vulnerable endpoint
# location /WeGIA/html/pessoa/editar_info_pessoal.php {
#     if ($args ~* "(<|%3C)script|onerror=|javascript:") { return 403; }
# }