Executive brief
WeGIA, a web-based management platform for charitable institutions, contains a security flaw that allows attackers to redirect users to malicious websites. By tricking a staff member or administrator into clicking a specially crafted link, an attacker can send them to a fake login page or a site hosting malware while making the link appear to come from the trusted WeGIA domain. This can lead to credential theft and compromise of the institution's sensitive data.
Technical details
An open redirect vulnerability exists in WeGIA prior to version 3.6.9 due to insufficient validation of the 'redirect' GET parameter in the 'atualizacao.php' component. The application takes the user-supplied URL directly from the query string and passes it to a PHP header("Location: ...") call without performing whitelist checks or domain validation. A remote attacker can exploit this by crafting a URL that points to an external malicious domain. Successful exploitation requires a victim to click the link (User Interaction), which can be used to facilitate phishing attacks or bypass security controls that rely on referrer headers. The issue is resolved in version 3.6.9.
Affected products
- LabRedesCefetRJ WeGIA < 3.6.9
Timeline
- 2026-04-02: advisory: GitHub Security Advisory published
- 2026-04-06: disclosed: NVD publication date
- 2026-04-06: patched: Fix released in version 3.6.9