PT-2025-4369 · Wegia · Wegia

Nmmorette · Published 2025-01-07 · Updated 2025-02-13 · CVE-2025-22132

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.2.7

Description A Cross-Site Scripting (XSS) vulnerability was identified in the file upload functionality of the "WeGIA/html/socio/sistema/controller/controla xlsx.php" endpoint. By uploading a file containing malicious JavaScript code, an attacker can execute arbitrary scripts in the context of a victim's browser. This can lead to information theft, session hijacking, and other forms of client-side exploitation.

Recommendations For versions prior to 3.2.7, update to version 3.2.7 to resolve the issue. As a temporary workaround, consider restricting access to the file upload functionality in the "WeGIA/html/socio/sistema/controller/controla xlsx.php" endpoint until the update is applied.

Exploit

Fix

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-434

Related Identifiers

CVE-2025-22132

GHSA-H8HR-JHCX-FCV9

Affected Products

Wegia

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22132.json · Exploit
• https://github.com/nilsonLazarin/WeGIA/security/advisories/GHSA-h8hr-jhcx-fcv9 · Vendor Advisory
• https://github.com/nilsonLazarin/WeGIA/commit/330f641db43cfb0c8ea8bb6025cc0732de4d4d6b · Patch
• https://osv.dev/vulnerability/CVE-2025-22132 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22132 · Security Note
• https://t.me/cvenotify/111262 · Telegram Post
• https://t.me/cvedetector/14610 · Telegram Post
• https://twitter.com/CVEnew/status/1876890084458557672 · Twitter Post
• https://twitter.com/CveFindCom/status/1876758634685698250 · Twitter Post