PT-2025-4603 · Wegia · Wegia

Lislovelly · Published 2025-01-13 · Updated 2025-02-13 · CVE-2025-22617

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.2.7

Description A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the editar socio.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the socio parameter. The application fails to validate and sanitize user inputs in the socio parameter, permitting the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser.

Recommendations For versions prior to 3.2.7, upgrade to version 3.2.7 to address the issue. As a temporary workaround, consider restricting access to the editar socio.php endpoint until the upgrade is applied. Additionally, avoid using the socio parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-22617

GHSA-8CP5-VR69-H8XX

Affected Products

Wegia

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22617.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/commit/35d374736cec39082ed297bb3cd55fa6286050ad · Patch
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-8cp5-vr69-h8xx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22617 · Security Note
• https://osv.dev/vulnerability/CVE-2025-22617 · Vendor Advisory
• https://t.me/cvenotify/111267 · Telegram Post
• https://twitter.com/CVEnew/status/1878913131625234634 · Twitter Post
• https://t.me/cvedetector/15178 · Telegram Post
• https://twitter.com/dailycve/status/1890143379348156557 · Twitter Post
• https://twitter.com/CVETracker/status/1879257365343506659 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1879024082521346190 · Twitter Post