Listen to this Post
How the CVE Works
The vulnerability exists in the `adicionar_raca.php` endpoint of WeGIA before version 3.4.5. Attackers can inject malicious JavaScript payloads into the `raca` parameter, which is stored in the database. When an admin or user accesses the affected page, the script executes automatically in their browser, leading to session hijacking, defacement, or unauthorized actions. The lack of input sanitization and output encoding allows the payload to persist and trigger upon page load.
DailyCVE Form
Platform: WeGIA
Version: < 3.4.5
Vulnerability: Stored XSS
Severity: Medium
Date: 07/25/2025
Prediction: Patch by 08/10/2025
What Undercode Say
Check vulnerable version curl -I http://target/wegia/adicionar_raca.php Exploit PoC (sanitized) POST /adicionar_raca.php HTTP/1.1 raca=<script>alert(1)</script>
How Exploit
1. Submit malicious script via `raca` parameter.
2. Payload stores in database.
3. Victim loads page, script executes.
Protection from this CVE
- Update to WeGIA 3.4.5.
- Sanitize `raca` input.
- Implement CSP headers.
Impact
- Session hijacking.
- Unauthorized admin actions.
- Data theft.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
