| Title | WeGIA WeGIA Web Gerenciador 3.4.0 Stored Cross Site Scripting |
|---|
| Description | A persistent Cross-Site Scripting (XSS) vulnerability has been identified in the WeGIA system, specifically in the output type registration flow within the module: Material > Patrimony > Register Output > Type. The flaw allows an attacker to inject malicious JavaScript code into the output type name field, which is then stored in the database and executed whenever the product registration interface is accessed. The script is executed in the browser context of any user interacting with the page, enabling potential session hijacking, unauthorized redirects, or other client-side attacks. The lack of proper input validation or sanitization represents a critical security flaw that compromises both the integrity of the application and the safety of its users.
1 - Log in to the platform.:
2 - Go to the section "Material e Patrimonio > Entrada > Registrar Saida":
3 - On the page /html/matPat/cadastro_saida.php, click the "+" button under the "Tipo" tab.
4 - On the page /html/matPat/adicionar_tipoSaida.php, register a new unit using the following XSS payload:
<script>alert('Poc VulDB')</script>
Then, click the first "Enviar" button to submit the form.
5 - The payload will be stored in the system and will be executed every time the page html/matPat/cadastro_saida.php is loaded, confirming the presence of a Stored Cross-Site Scripting (XSS) vulnerability.
|
|---|
| Source | ⚠️ https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README6.md |
|---|
| User | RaulPACXXX (UID 84502) |
|---|
| Submission | 06/16/2025 01:31 (1 Year ago) |
|---|
| Moderation | 06/26/2025 10:11 (10 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 313964 [LabRedesCefetRJ WeGIA 3.4.0 Adicionar tipo adicionar_tipoSaida.php Insira o novo tipo cross site scripting] |
|---|
| Points | 20 |
|---|