Executive brief
WeGIA, a web-based management platform for charitable institutions, contains a security flaw that allows authorized users to inject malicious code into the system. This code is stored and then executed in the browsers of other staff members when they view specific process management pages. An exploit could lead to the theft of login sessions or full account takeover, potentially compromising sensitive data related to the institution's operations and beneficiaries.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in WeGIA versions prior to 3.7.3 within the 'Etapas de um Processo' component (html/atendido/etapa_processo.php). The root cause is the application's failure to properly sanitize or encode the 'description' field when registering a process stage (etapa). An authenticated attacker with high privileges can inject a malicious payload (e.g., via an <img> tag with an onerror attribute) that is stored in the database. When other users navigate to the affected page, the payload executes in their browser context, allowing for session cookie theft and arbitrary action performance. This issue is resolved in version 3.7.3.
Affected products
- LabRedesCefetRJ WeGIA < 3.7.3
Timeline
- 2026-05-06: advisory: Original GitHub security advisory published
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Vulnerability fixed in version 3.7.3