WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the novo_memorandoo.php endpoint. An attacker can inject arbitrary JavaScript into the sccs GET parameter, which is directly echoed into the HTML response without any sanitization or encoding. The script /html/memorando/novo_memorandoo.php reads HTTP GET parameters to display dynamic success messages to the user. At approximately line 273, the code checks if $_GET['msg'] equals 'success'. If true, it directly concatenates $_GET['sccs'] into an HTML alert <div> and outputs it to the browser. This issue has been fixed in version 3.6.7.
The /html/memorando/novo_memorandoo.php script reads GET parameters to display dynamic operation success messages. Around line 273, the code checks if the $_GET['msg'] parameter equals 'success', and if so, directly concatenates the $_GET['sccs'] value into an HTML alert <div> element and sends it to the browser. The absence of any validation, encoding, or sanitization means that any JavaScript payload contained in the 'sccs' parameter will be executed in the victim's browser context. The attack requires tricking the user into clicking an appropriately crafted link (UI:R), but executes in a cross-domain context (S:C), which increases its severity.
An attacker can execute arbitrary JavaScript code in the victim's browser, enabling session theft, credential theft, page content manipulation, and conducting further attacks on the user or institution using the WeGIA system.
WeGIA should be updated to version 3.6.7, where the issue has been resolved. The patch is available in the project repository and in official release notes at https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.7
WeGIA in versions 3.6.6 and earlier
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NWegia
APPWegia< 3.6.7
Related vulnerabilities
Reflected XSS w WeGIA — wstrzyknięcie kodu przez parametr sccd
SQL Injection w WeGIA — kompromitacja bazy danych przez parametr id_produto
SQL Injection w WeGIA – nieautoryzowane wykonanie poleceń SQL
WeGIA – pominięcie uwierzytelnienia w adicionar_tipo_docs_atendido.php
WeGIA – RCE przez command injection w funkcji przywracania bazy danych