CVE-2025-6696: Wegia WeGIA Cross-Site Scripting Vulnerability

CVE-2025-6696 Overview

CVE-2025-6696 is a cross-site scripting (XSS) vulnerability in LabRedesCefetRJ WeGIA version 3.4.0. The flaw resides in the /html/atendido/Cadastro_Atendido.php file, part of the Cadastro de Atendido component. Attackers manipulate the Nome and Sobrenome parameters to inject arbitrary script content that executes in the victim's browser session. The issue is distinct from CVE-2025-22615, which affects a different code path in the same application. Remote exploitation is possible, and a public proof-of-concept has been disclosed. The vendor was contacted but did not respond to the disclosure, leaving users of version 3.4.0 without an official fix at publication time.

Critical Impact
Remote attackers can inject JavaScript into the Cadastro de Atendido form via unsanitized Nome and Sobrenome fields, enabling session theft and UI redressing against authenticated WeGIA users.

Affected Products

LabRedesCefetRJ WeGIA 3.4.0
Component: Cadastro de Atendido (/html/atendido/Cadastro_Atendido.php)
Vulnerable parameters: Nome, Sobrenome

Discovery Timeline

2025-06-26 - CVE-2025-6696 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6696

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw classified under [CWE-79]. The Cadastro_Atendido.php endpoint accepts the Nome and Sobrenome form parameters and renders their values back into the HTML response without proper output encoding. An attacker crafts a malicious payload in either parameter and delivers it through a phishing link or an attacker-controlled form submission. User interaction is required for successful exploitation, consistent with the UI:P attribute in the CVSS vector. Low privileges are also required, meaning the attacker needs an authenticated low-tier account to reach the vulnerable form. Successful execution runs attacker-controlled JavaScript in the context of the WeGIA session, limited to integrity impact on the targeted user.

Root Cause

The root cause is missing input sanitization and output encoding on the Nome and Sobrenome request parameters in /html/atendido/Cadastro_Atendido.php. The PHP code reflects user-supplied values directly into rendered HTML without escaping characters such as <, >, ", and '. WeGIA does not enforce a Content Security Policy that would mitigate inline script execution for this view.

Attack Vector

Exploitation occurs over the network against an authenticated WeGIA user. An attacker crafts a URL or form submission that embeds a JavaScript payload within the Nome or Sobrenome field of the Cadastro de Atendido workflow. When the victim submits or loads the response, the browser parses the reflected payload and executes the attacker's script. The public proof-of-concept is documented in the GitHub PoC Repository and tracked in VulDB #313962.

No verified exploit code is reproduced here. Refer to the linked PoC repository for the exact payload format used by the public disclosure.

Detection Methods for CVE-2025-6696

Indicators of Compromise

HTTP POST or GET requests to /html/atendido/Cadastro_Atendido.php containing <script, onerror=, onload=, or URL-encoded equivalents in the Nome or Sobrenome parameters.
Web server access logs showing unusually long Nome or Sobrenome values with HTML metacharacters.
Browser console errors or outbound requests to attacker-controlled domains originating from WeGIA pages.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect Cadastro_Atendido.php request bodies for script tags, event handlers, and encoded XSS payloads.
Enable server-side request logging that captures full POST bodies for the /html/atendido/ directory to support retrospective hunting.
Correlate authenticated session activity with anomalous referer headers or payload patterns indicative of social-engineering delivery.

Monitoring Recommendations

Alert on repeated form submissions from a single session containing HTML or JavaScript metacharacters in name fields.
Monitor browser-side telemetry for Content Security Policy violation reports once a CSP is deployed.
Review Cadastro de Atendido entries created in the last 90 days for stored payloads that may indicate attempted or successful injection.

How to Mitigate CVE-2025-6696

Immediate Actions Required

Restrict access to /html/atendido/Cadastro_Atendido.php to trusted internal networks until a patch is available.
Audit all WeGIA 3.4.0 deployments and inventory low-privileged accounts that can reach the Cadastro de Atendido form.
Apply a WAF virtual patch that strips or rejects HTML and JavaScript metacharacters in the Nome and Sobrenome parameters.
Educate users with WeGIA access to avoid clicking unsolicited links referencing the atendido forms.

Patch Information

No vendor patch is referenced in the NVD record. The maintainers at LabRedesCefetRJ were contacted during the disclosure process but did not respond. Monitor the WeGIA project repository for future releases that address /html/atendido/Cadastro_Atendido.php, and track updates through VulDB CTI #313962.

Workarounds

Implement a strict Content Security Policy that blocks inline scripts and restricts script sources on the WeGIA application.
Apply server-side input validation that rejects non-alphabetic characters in the Nome and Sobrenome fields.
Enforce output encoding using htmlspecialchars($value, ENT_QUOTES, 'UTF-8') on all reflected user input in affected PHP templates.
Rotate session cookies and set HttpOnly and SameSite=Strict attributes to reduce the impact of script execution.

bash

# Example nginx WAF-style filter rejecting HTML metacharacters on the vulnerable endpoint
location /html/atendido/Cadastro_Atendido.php {
    if ($args ~* "(<|%3C)script|onerror=|onload=|javascript:") {
        return 403;
    }
    if ($request_body ~* "(<|%3C)script|onerror=|onload=") {
        return 403;
    }
}