Listen to this Post
How the CVE Works
The vulnerability exists in the `personalizacao_selecao.php` endpoint of WeGIA versions before 3.4.5. Attackers can exploit this flaw by injecting malicious JavaScript code into the `nome_car` parameter, which is reflected back in the web page without proper sanitization. When a victim interacts with a crafted URL, the script executes in their browser, potentially leading to session hijacking, phishing, or other client-side attacks. The issue arises due to insufficient input validation and output encoding in the affected endpoint.
DailyCVE Form
Platform: WeGIA
Version: < 3.4.5
Vulnerability: Reflected XSS
Severity: Medium
Date: 07/16/2025
Prediction: Patch by 08/15/2025
What Undercode Say
curl -X GET "http://example.com/personalizacao_selecao.php?nome_car=<script>alert(1)</script>"
import requests
payload = "<script>alert('XSS')</script>"
response = requests.get(f"http://target.com/personalizacao_selecao.php?nome_car={payload}")
How Exploit
Craft a malicious URL with JavaScript in nome_car, trick users into clicking it.
Protection from this CVE
Update to WeGIA 3.4.5.
Impact
Session theft, phishing.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
