Executive brief
WeGIA is a web-based management platform used by charitable institutions to organize their operations. A security flaw allows attackers to create malicious links that appear to be legitimate WeGIA URLs but redirect users to external, untrusted websites. This can be used in phishing campaigns to steal staff credentials or distribute malware by exploiting the trust users have in the institution's official domain.
Technical details
An open redirect vulnerability exists in WeGIA versions prior to 3.6.9 due to insufficient validation of the 'nextPage' GET parameter in the /WeGIA/controle/control.php endpoint. The flaw is specifically exploitable when the 'metodo' parameter is set to 'listarId' and 'nomeClasse' is set to 'IsaidaControle'. A remote, unauthenticated attacker can craft a URL that, when clicked by a victim, redirects the browser to an arbitrary external domain. This occurs because the application trustingly appends the user-supplied URL to a redirection header without verifying if the destination is local or authorized. The vulnerability has been addressed in version 3.6.9 by implementing proper input validation.
Affected products
- LabRedesCefetRJ WeGIA < 3.6.9
Timeline
- 2026-04-02: advisory: GitHub Security Advisory published by vendor
- 2026-04-06: disclosed: CVE published to NVD
- 2026-04-06: patched: Vulnerability fixed in version 3.6.9