Listen to this Post
How the CVE Works
The vulnerability exists in the `adicionar_cor.php` endpoint of WeGIA (< v3.4.5). Attackers can inject malicious JavaScript via the `cor` parameter, which is stored in the database. When users access cadastro_pet.php, the script executes automatically in their browsers. This stored XSS allows session hijacking, defacement, or malware distribution. The issue arises due to insufficient input sanitization before storing user-supplied data.
DailyCVE Form
Platform: WeGIA
Version: < 3.4.5
Vulnerability: Stored XSS
Severity: Medium
Date: 07/16/2025
Prediction: Patch expected by 08/10/2025
What Undercode Say
curl -X POST http://example.com/adicionar_cor.php -d "cor=<script>alert(1)</script>"
SELECT FROM cores WHERE cor LIKE '%<script>%';
Exploit
1. Craft malicious payload: ``
2. Submit via `adicionar_cor.php`.
3. Trigger execution via `cadastro_pet.php`.
Protection from this CVE
- Update to WeGIA 3.4.5.
- Sanitize `cor` input (e.g., HTML entity encoding).
- Implement CSP headers.
Impact
- Session hijacking.
- Unauthorized actions.
- Data theft.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
