CVE-2026-33136: Wegia Wegia Reflected XSS Vulnerability

CVE-2026-33136 Overview

CVE-2026-33136 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting WeGIA, an open-source web manager designed for charitable institutions. The vulnerability exists in the listar_memorandos_ativos.php endpoint within the Memorando module, where the sccd GET parameter is reflected directly into the HTML response without proper sanitization or encoding.

An attacker can craft a malicious URL containing arbitrary JavaScript or HTML tags in the sccd parameter. When a victim clicks on this link, the malicious script executes in their browser within the context of the WeGIA application, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of the authenticated user.

Critical Impact

This XSS vulnerability enables attackers to execute arbitrary JavaScript in authenticated user sessions, potentially compromising sensitive charitable institution data and user credentials.

Affected Products

• WeGIA versions 3.6.6 and below
• WeGIA Memorando module (/html/memorando/listar_memorandos_ativos.php)

Discovery Timeline

• 2026-03-20 - CVE-2026-33136 published to NVD
• 2026-03-20 - Last updated in NVD database

Technical Details for CVE-2026-33136

Vulnerability Analysis

The vulnerability resides in how the listar_memorandos_ativos.php script handles dynamic success messages displayed to users. The endpoint processes query string parameters to determine what content to display. Specifically, when $_GET['msg'] equals success, the script directly concatenates and reflects the value of $_GET['sccd'] into an HTML alert <div> element without any input validation, sanitization, or output encoding.

This implementation pattern is consistent with other vulnerable endpoints discovered in the Memorando module. The lack of security controls allows attackers to inject arbitrary HTML and JavaScript that will be rendered and executed by the victim's browser.

Root Cause

The root cause is improper input validation and missing output encoding (CWE-79). The application fails to sanitize user-controlled input from the sccd GET parameter before including it in the HTML response. This violates the principle of treating all user input as untrusted and demonstrates a lack of context-aware output encoding when rendering dynamic content.

Attack Vector

The attack is network-based and requires user interaction. An attacker must craft a malicious URL containing JavaScript payload in the sccd parameter and trick a victim into clicking the link. The attack flow is as follows:

1. Attacker constructs a URL targeting listar_memorandos_ativos.php with msg=success and a malicious sccd value containing JavaScript
2. Attacker delivers the malicious URL to the victim via phishing email, social engineering, or embedding it in a website
3. Victim clicks the link while authenticated to WeGIA
4. The server reflects the malicious payload directly into the HTML response
5. Victim's browser executes the injected JavaScript in the context of the WeGIA session
6. Attacker's script can steal session cookies, perform actions as the victim, or redirect to phishing pages

The vulnerability can be exploited by injecting HTML tags and JavaScript event handlers into the sccd parameter. For example, a crafted payload containing script tags or event handlers would be reflected directly into the alert <div> element, causing the browser to execute the malicious code. For detailed technical information, see the GitHub Security Advisory GHSA-xjqp-5q3h-2cxh.

Detection Methods for CVE-2026-33136

Indicators of Compromise

• Suspicious HTTP GET requests to /html/memorando/listar_memorandos_ativos.php containing <script> tags, event handlers (e.g., onerror, onload), or JavaScript protocol handlers in the sccd parameter
• Web server logs showing URL-encoded HTML/JavaScript characters (%3C, %3E, %22) in query strings to the Memorando module
• User reports of unexpected redirects or browser behavior when accessing WeGIA memorando listings
• Evidence of session cookie exfiltration or unauthorized actions performed by legitimate user accounts

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in query string parameters targeting WeGIA endpoints
• Configure intrusion detection systems (IDS) to alert on HTTP requests containing common XSS patterns such as <script>, javascript:, and event handler attributes
• Enable detailed web server access logging and establish baseline patterns for legitimate listar_memorandos_ativos.php requests
• Deploy Content Security Policy (CSP) headers to mitigate the impact of successful XSS attacks by restricting inline script execution

Monitoring Recommendations

• Monitor web server access logs for anomalous requests to the Memorando module with unusual query parameter lengths or special characters
• Implement real-time alerting for multiple failed or suspicious requests from the same IP address targeting WeGIA endpoints
• Review authentication logs for session anomalies that may indicate session hijacking following XSS exploitation
• Establish regular log reviews focusing on the /html/memorando/ directory and related PHP endpoints

How to Mitigate CVE-2026-33136

Immediate Actions Required

• Upgrade WeGIA to version 3.6.7 or later immediately to address this vulnerability
• Review web server logs for evidence of exploitation attempts targeting the listar_memorandos_ativos.php endpoint
• Implement a WAF rule to filter malicious input in the sccd parameter as a temporary protective measure
• Notify users to be cautious of suspicious links claiming to direct to WeGIA memorando pages
• Consider temporarily disabling the Memorando module if upgrading is not immediately possible

Patch Information

The vulnerability has been resolved in WeGIA version 3.6.7. Organizations should update to this version or later as soon as possible. The patch is available from the GitHub WeGIA Release 3.6.7. The fix implements proper input sanitization and output encoding for user-controlled parameters rendered in HTML responses.

Workarounds

• Deploy a Web Application Firewall (WAF) with rules to block requests containing HTML tags or JavaScript in query parameters to WeGIA
• Implement server-side input validation at the web server level (e.g., using Apache mod_security or Nginx rules) to reject malicious requests before they reach the application
• Configure Content Security Policy (CSP) headers to prevent inline script execution, reducing the impact of successful XSS attacks
• Restrict access to the Memorando module to trusted networks or authenticated users only while awaiting the patch deployment

# Example Apache mod_rewrite rule to block XSS attempts (temporary workaround)
# Add to .htaccess or Apache configuration

RewriteEngine On
RewriteCond %{QUERY_STRING} (<script|javascript:|onerror=|onload=) [NC]
RewriteRule ^html/memorando/listar_memorandos_ativos\.php$ - [F,L]

# Example Content-Security-Policy header
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'"