CVE-2026-33135: Wegia Web Manager XSS Vulnerability

CVE-2026-33135 Overview

CVE-2026-33135 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting WeGIA, a web manager designed for charitable institutions. The vulnerability exists in the novo_memorandoo.php endpoint in versions 3.6.6 and below, where an attacker can inject arbitrary JavaScript code through the sccs GET parameter. The malicious script is directly echoed into the HTML response without any sanitization or encoding, enabling attackers to execute arbitrary code in the context of a victim's browser session.

Critical Impact

Attackers can steal session cookies, redirect users to malicious sites, deface web content, or perform actions on behalf of authenticated users by crafting malicious URLs that exploit this XSS vulnerability.

Affected Products

• WeGIA versions 3.6.6 and below
• WeGIA web manager installations using the novo_memorandoo.php endpoint
• Charitable institution management systems running vulnerable WeGIA versions

Discovery Timeline

• March 20, 2026 - CVE-2026-33135 published to NVD
• March 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-33135

Vulnerability Analysis

This Reflected XSS vulnerability stems from improper input validation in the WeGIA application. The vulnerable script located at /html/memorando/novo_memorandoo.php processes HTTP GET parameters to display dynamic success messages to users. At approximately line 273, the code evaluates whether the $_GET['msg'] parameter equals success. When this condition is met, the application directly concatenates the value from $_GET['sccs'] into an HTML alert <div> element and outputs it to the browser without any sanitization, encoding, or validation.

This creates a direct injection point where user-controlled input flows unsanitized into the rendered HTML, allowing attackers to inject and execute arbitrary JavaScript code in the victim's browser context. The attack requires user interaction—a victim must click a malicious link crafted by the attacker.

Root Cause

The root cause of this vulnerability is the absence of proper input sanitization and output encoding. The application directly incorporates user-supplied data from the sccs GET parameter into HTML output without applying any protective measures such as:

• HTML entity encoding
• Input validation or whitelisting
• Content Security Policy (CSP) headers
• Contextual output escaping

The PHP code assumes trust in GET parameter values and echoes them directly into the page, violating secure coding principles for handling user input.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a malicious URL targeting the novo_memorandoo.php endpoint with JavaScript code injected into the sccs parameter. When a victim (typically an authenticated user of the WeGIA system) clicks the malicious link, the injected script executes in their browser session.

A typical attack flow involves crafting a URL where the msg parameter is set to success and the sccs parameter contains malicious JavaScript payload. When processed by the vulnerable endpoint, the script is rendered directly in the HTML response. The attacker could leverage this to steal session tokens stored in cookies, perform unauthorized actions using the victim's authenticated session, redirect users to phishing or malware distribution sites, or modify page content to display misleading information.

Detection Methods for CVE-2026-33135

Indicators of Compromise

• Unusual URL patterns in web server logs containing JavaScript code in the sccs parameter of requests to novo_memorandoo.php
• HTTP requests to /html/memorando/novo_memorandoo.php with msg=success and suspicious encoded characters in the sccs parameter
• Reports from users about unexpected browser behavior or redirects when accessing WeGIA memorandum features
• Web Application Firewall (WAF) alerts for XSS patterns targeting the affected endpoint

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common XSS patterns in GET parameters, particularly targeting the sccs and msg parameters
• Enable verbose web server logging and monitor for requests containing script tags, event handlers, or JavaScript URI schemes in query strings
• Implement browser-based XSS auditor alerts and Content Security Policy (CSP) violation reporting
• Conduct regular vulnerability scanning targeting reflected XSS in web application endpoints

Monitoring Recommendations

• Configure log analysis tools to alert on requests containing potential XSS payloads such as <script>, javascript:, onerror=, or similar patterns in URL parameters
• Monitor for unusual patterns of access to the novo_memorandoo.php endpoint, especially from external referrers
• Implement real-time alerting for CSP violations that may indicate attempted XSS exploitation

How to Mitigate CVE-2026-33135

Immediate Actions Required

• Upgrade WeGIA to version 3.6.7 or later, which contains the fix for this vulnerability
• Review web server access logs for any signs of exploitation attempts targeting the novo_memorandoo.php endpoint
• Implement or update Web Application Firewall rules to block XSS payloads in the sccs GET parameter
• Notify users to be cautious of suspicious links pointing to the WeGIA application

Patch Information

The vulnerability has been addressed in WeGIA version 3.6.7. The fix can be obtained from the official GitHub release. The security patch was implemented through Pull Request #1459. For detailed information about the vulnerability and remediation, refer to the GitHub Security Advisory GHSA-w5rv-5884-w94v.

Workarounds

• If immediate patching is not possible, restrict access to the novo_memorandoo.php endpoint using web server access controls or firewall rules
• Implement a reverse proxy or WAF rule to strip or encode the sccs parameter before it reaches the application
• Apply a temporary code fix to sanitize the sccs parameter using PHP's htmlspecialchars() function with ENT_QUOTES flag before output
• Configure Content Security Policy headers to mitigate the impact of XSS by restricting inline script execution

# Example Apache .htaccess workaround to block suspicious requests
# Add to .htaccess in the WeGIA web root
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} sccs=.*(<|>|script|javascript|onerror) [NC]
    RewriteRule ^html/memorando/novo_memorandoo\.php$ - [F,L]
</IfModule>