PT-2025-4780 · Wegia · Wegia

Lislovelly · Published 2025-01-13 · Updated 2025-02-13 · CVE-2025-23034

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.2.6

Description A Reflected Cross-Site Scripting (XSS) issue was identified in the tags.php endpoint of the WeGIA application. This issue allows attackers to inject malicious scripts in the msg e parameter due to the application's failure to validate and sanitize user inputs. The lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser.

Recommendations For versions prior to 3.2.6, upgrade to version 3.2.6 or later to address the issue. As a temporary workaround, consider restricting access to the tags.php endpoint until the upgrade is applied. Additionally, avoid using the msg e parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-23034

GHSA-V68M-2RVF-8R25

Affected Products

Wegia

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23034.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v68m-2rvf-8r25 · Vendor Advisory
• https://github.com/LabRedesCefetRJ/WeGIA/commit/8a37021417d9c55e61392b3cc52baa3c73102bab · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-23034 · Security Note
• https://osv.dev/vulnerability/CVE-2025-23034 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1879059925822853244 · Twitter Post
• https://t.me/cvenotify/111270 · Telegram Post
• https://t.me/cvedetector/15209 · Telegram Post
• https://twitter.com/CVEnew/status/1878988160778014997 · Twitter Post