CVE-2026-23724: WeGIA Stored XSS Vulnerability

CVE-2026-23724 Overview

CVE-2026-23724 is a Stored Cross-Site Scripting (XSS) vulnerability identified in WeGIA, a web manager application designed for charitable institutions. The vulnerability exists in the html/atendido/cadastro_ocorrencia.php endpoint where the application fails to properly sanitize user-controlled data before rendering it inside the "Atendido" selection dropdown. This allows attackers with authenticated access to inject malicious scripts that persist and execute in the context of other users' browsers.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in victims' browsers, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of users within the WeGIA charitable institution management system.

Affected Products

• WeGIA versions prior to 3.6.2
• WeGIA web manager for charitable institutions

Discovery Timeline

• January 16, 2026 - CVE-2026-23724 published to NVD
• January 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23724

Vulnerability Analysis

This Stored XSS vulnerability (CWE-79) occurs due to improper neutralization of input during web page generation. The WeGIA application accepts user-supplied data that is stored in the database and subsequently rendered within the "Atendido" selection dropdown without proper sanitization or output encoding. When other users access the affected page, the malicious payload executes in their browser context.

The vulnerability requires authenticated access to exploit, making it a post-authentication attack vector. However, once injected, the malicious script persists and affects all users who view the affected dropdown element, including administrators with elevated privileges.

Root Cause

The root cause is the absence of input validation and output encoding in the cadastro_ocorrencia.php endpoint. User-controlled data is directly inserted into the HTML response without being sanitized for potentially dangerous characters or scripts. This violates the fundamental security principle of never trusting user input and always encoding output based on the rendering context.

Attack Vector

The attack is network-accessible and requires low-privileged authenticated access to the WeGIA application. An attacker would submit a malicious payload containing JavaScript code through the vulnerable form field. This payload is stored in the application's database and subsequently retrieved and rendered in the "Atendido" selection dropdown whenever the affected page is loaded.

The malicious script could perform various actions including stealing session cookies, redirecting users to phishing sites, modifying page content, or performing actions on behalf of authenticated users. For technical implementation details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-23724

Indicators of Compromise

• Unusual JavaScript code or HTML tags stored in database fields related to the "Atendido" functionality
• Unexpected script execution or browser behavior when accessing the cadastro_ocorrencia.php page
• Web application firewall logs showing blocked XSS patterns targeting the vulnerable endpoint
• User reports of suspicious redirects or unexpected behavior within the WeGIA application

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS payloads targeting form submissions
• Monitor server logs for requests containing script tags, event handlers, or encoded JavaScript in POST parameters to cadastro_ocorrencia.php
• Conduct regular security scans using tools capable of detecting stored XSS vulnerabilities
• Review database content for suspicious entries containing HTML or JavaScript in user-controllable fields

Monitoring Recommendations

• Enable detailed logging for all form submissions within the WeGIA application
• Configure intrusion detection systems to alert on XSS signature patterns in HTTP traffic
• Implement Content Security Policy (CSP) headers to restrict script execution sources and detect policy violations
• Regularly audit user-generated content stored in the database for malicious payloads

How to Mitigate CVE-2026-23724

Immediate Actions Required

• Upgrade WeGIA to version 3.6.2 or later immediately, as this release contains the security fix
• Review database content for any stored malicious payloads and sanitize affected records
• Implement Content Security Policy headers to reduce the impact of any existing XSS vulnerabilities
• Enable Web Application Firewall rules to block XSS attack patterns while patching is in progress

Patch Information

The vulnerability has been addressed in WeGIA version 3.6.2. Organizations should upgrade to this version or later to remediate the vulnerability. The fix is documented in GitHub Pull Request #1333 and the patched version is available at the official release page. For complete vulnerability details, review the GitHub Security Advisory GHSA-3r3q-8573-g3cq.

Workarounds

• Implement server-side input validation to reject or sanitize potentially malicious input before storage
• Apply output encoding using context-appropriate encoding functions when rendering user-supplied data
• Deploy a Web Application Firewall with XSS protection rules as a temporary mitigation layer
• Restrict access to the vulnerable endpoint to only essential users until the patch is applied

# Example: Add Content Security Policy header in Apache configuration
# Add to .htaccess or Apache virtual host configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"