CVE-2025-67496 Overview
CVE-2025-67496 is a stored Cross-Site Scripting (XSS) vulnerability in WeGIA, an open source web manager for institutions targeting Portuguese-language users. The flaw affects the /WeGIA/html/geral/configurar_senhas.php endpoint in versions 3.5.4 and earlier. The application retrieves employee names from the database and injects them directly into HTML <option> elements without proper escaping. Attackers with authenticated access can persist malicious JavaScript that executes when administrators load the password configuration dropdown. The issue is fixed in version 3.5.5.
Critical Impact
Attackers can execute arbitrary JavaScript in administrator browsers, enabling session theft, credential harvesting, and unauthorized actions against the WeGIA management interface.
Affected Products
- WeGIA versions 3.5.4 and earlier
- Component: wegia:wegia
- Endpoint: /WeGIA/html/geral/configurar_senhas.php
Discovery Timeline
- 2025-12-09 - CVE-2025-67496 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2025-67496
Vulnerability Analysis
The vulnerability is a stored Cross-Site Scripting (XSS) issue classified under [CWE-79]. WeGIA stores employee records in a backing database and renders employee names inside an HTML selection dropdown on the password configuration page. The application does not apply output encoding when writing those values into <option> elements. An attacker who can insert or modify an employee record with a crafted name payload turns the dropdown into a persistent XSS sink.
Because the payload is stored server-side, every user who loads configurar_senhas.php triggers execution in their browser context. The vulnerability requires low privileges to inject the payload and user interaction to trigger it against a victim, with a scope change that extends impact beyond the vulnerable component.
Root Cause
The root cause is missing output sanitization in the server-side rendering of the employee selection dropdown. Employee names retrieved from the database are concatenated directly into HTML markup without HTML entity encoding. Any special characters such as <, >, and " pass through unchanged, enabling script tag injection or event handler attributes inside the <option> element.
Attack Vector
Exploitation requires an authenticated user who can create or modify an employee record. The attacker stores a JavaScript payload inside the employee name field. When an administrator or other privileged user opens the password configuration page, the browser parses the attacker-controlled markup and executes the embedded script. The payload runs in the victim's authenticated session, allowing cookie theft, forced requests to administrative endpoints, or client-side modification of WeGIA pages. See the GHSA-9843-qm67-73h2 advisory for additional detail.
Detection Methods for CVE-2025-67496
Indicators of Compromise
- Employee records containing HTML tags, <script> fragments, or JavaScript event handlers such as onerror= or onload= in name fields.
- Unexpected outbound requests from administrator browsers after loading /WeGIA/html/geral/configurar_senhas.php.
- Web server access logs showing repeated requests to employee creation or edit endpoints from a single low-privilege account.
Detection Strategies
- Query the WeGIA database for employee name values containing angle brackets, quotes, or JavaScript keywords.
- Review HTTP response bodies from configurar_senhas.php for unencoded < or > characters inside <option> tags.
- Monitor browser Content Security Policy (CSP) violation reports for inline script execution originating from WeGIA pages.
Monitoring Recommendations
- Enable web application firewall (WAF) rules that flag HTML and JavaScript tokens submitted to WeGIA form fields.
- Log all create and update operations against employee records, including the submitting account and raw field values.
- Alert on administrator session cookies appearing in outbound traffic to untrusted domains following WeGIA page loads.
How to Mitigate CVE-2025-67496
Immediate Actions Required
- Upgrade WeGIA to version 3.5.5 or later, which contains the official fix.
- Audit the employee table for stored payloads and sanitize or remove any records containing HTML or script content.
- Rotate administrator credentials and invalidate active sessions if exploitation is suspected.
Patch Information
The maintainers resolved the issue in WeGIA 3.5.5. The upstream fix is tracked in commit c80b8cac, which adds proper output encoding when rendering employee data into the dropdown. Review the GitHub Security Advisory GHSA-9843-qm67-73h2 for the full fix description.
Workarounds
- Restrict access to employee creation and editing functions to trusted administrative users until patching is complete.
- Deploy a WAF rule that blocks requests containing HTML special characters in employee name parameters.
- Apply a strict Content Security Policy (CSP) that disallows inline scripts to limit the impact of injected payloads.
# Upgrade WeGIA to the patched release
git fetch --tags
git checkout 3.5.5
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
