WeGIA CVE-2025-62361

Requires an authenticated low-privilege session (CVSS PR:L) able to reach the control.php endpoint invoked with metodo=listarTodos and nomeClasse=AlmoxarifeControle in WeGIA versions prior to 3.5.0, where the nextPage parameter was passed to header('Location: ...') after only a FILTER_VALIDATE_URL check that accepts arbitrary absolute external URLs. Exploitation is LIMITED by: (1) required victim user interaction (CVSS UI:A) - the target must click the attacker-crafted link; (2) the authentication gate on the endpoint, so this is not an unauthenticated internet-facing redirect; and (3) version - fixed in 3.5.0, which hardcodes the redirect to WWW . 'html/matPat/listar_almoxarife.php' and removes attacker control of the destination.

This is a genuine-but-low-priority issue, not a top-tier emergency. The CVSS 4.0 base score of 4.8 (Medium) reflects an Open Redirect (CWE-601) with network attack vector (AV:N), low complexity (AC:L), but requiring low-privilege authentication (PR:L) and active user interaction (UI:A), with only low confidentiality and integrity impact (VC:L/VI:L) and no availability impact. These signals are internally consistent - the flaw cannot be exploited server-side alone; it depends on a victim clicking an attacker-crafted link. The EPSS score of 0.22% (12th percentile) corroborates low likelihood of mass exploitation, which is expected for an open redirect that yields no direct code execution or data compromise. Publicly available exploit code exists (GitHub Security Advisory GHSA-m99c-77f2-gpjx), but there is NO CISA KEV listing and no evidence of active exploitation; POC availability and active exploitation are distinct signals and must not be conflated here. The authentication requirement (PR:L per the CVSS vector) meaningfully limits reach - an attacker needs a valid low-privilege session to reach the vulnerable control.php endpoint, which reduces this from an open internet-facing redirect to one gated behind login. Net assessment: a real defect worth patching in the normal cycle, but driven by phishing/credential-theft utility rather than direct system compromise; not a drop-everything priority.

An attacker with a low-privilege authenticated session crafts a URL to control.php (metodo=listarTodos, nomeClasse=AlmoxarifeControle) with the nextPage parameter pointing to an attacker-controlled external domain, then lures a WeGIA user into clicking it (e.g., via a help-desk or internal message). The victim is silently redirected from the trusted WeGIA origin to a lookalike phishing page that harvests credentials or serves a malicious payload. Publicly available exploit/advisory detail (GHSA-m99c-77f2-gpjx) lowers the barrier to reproduction.