| 标题 | WeGIA WeGIA Web Gerenciador 3.4.0 Stored Cross Site Scripting |
|---|
| 描述 | A persistent Cross-Site Scripting (XSS) vulnerability has been identified in the WeGIA system, specifically in the entry type registration flow within the module: Material > Patrimony > Entry > Type. The flaw allows an attacker to inject malicious JavaScript code into the entry type name field, which is then stored in the database and executed whenever the product registration interface is accessed. The script runs in the browser context of any user interacting with the page, enabling potential session hijacking, unauthorized redirects, or other client-side attacks. The lack of proper input validation or sanitization represents a critical security flaw that compromises both the integrity of the application and the safety of its users.
1 - Log in to the platform
2 - Go to the section "Material e Patrimonio > Entrada > Registrar Entrada"
3 - On the page /html/matPat/cadastro_produto.php, click the "+" button under the "Tipo" tab.
4 - On the page /html/matPat/adicionar_tipoEntrada.php, register a new unit using the following XSS payload:
<script>alert('Poc VulDB')</script>
Then, click the first "Enviar" button to submit the form.
5 - The payload will be stored in the system and will be executed every time the page /html/matPat/cadastro_entrada.php is loaded, confirming the presence of a Stored Cross-Site Scripting (XSS) vulnerability.
|
|---|
| 来源 | ⚠️ https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README5.md |
|---|
| 用户 | RaulPACXXX (UID 84502) |
|---|
| 提交 | 2025-06-16 01時15分 (1 年前) |
|---|
| 管理 | 2025-06-26 10時11分 (10 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 313963 [LabRedesCefetRJ WeGIA 3.4.0 Adicionar tipo adicionar_tipoEntrada.php Insira o novo tipo 跨网站脚本] |
|---|
| 积分 | 20 |
|---|