WeGIA CVE-2025-62597

Exploitation targets the GET /WeGIA/html/pessoa/editar_info_pessoal.php endpoint via the sql parameter, which in versions prior to 3.5.1 is reflected unsanitized into the response (the pre-patch code used extract($_REQUEST) and echo(json_encode($_GET)) and lacked an exit() after the unauthenticated redirect). A victim must open the attacker-crafted link in a browser for the injected script to execute, so social-engineering delivery and user interaction are the primary limiting factors; impact is confined to client-side script execution in the WeGIA web context with no server-side confidentiality or availability impact. Fixed in WeGIA 3.5.1.

This is a genuine but moderate-risk reflected XSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with a 6.9 base score only scores SI:L (subsequent-system integrity low) and no confidentiality/availability impact, which correctly frames this as script injection in a victim's browser rather than server compromise. Note the vendor vector lists UI:N, which is unusual for a reflected XSS that normally requires a victim to click a crafted link - the source evidence explains it: the old editar_info_pessoal.php echoed json_encode($_GET) and the unauthenticated-redirect path lacked an exit(), so the reflection fired even without a valid session (hence PR:N is defensible, but realistic exploitation still needs victim interaction, so I assess UI:R/UI:A). Exploitation signals are modest: EPSS is 0.29% (20th percentile) indicating low predicted exploitation volume, there is NO CISA KEV listing, but publicly available exploit code exists via the GitHub Security Advisory. Taken together this is a confirmed, patchable, low-to-moderate priority issue - a real flaw with a public PoC but no evidence of active or widespread exploitation, and impact bounded to client-side script execution.

An attacker crafts a URL such as GET /WeGIA/html/pessoa/editar_info_pessoal.php?sql=<script>...</script> and delivers it to a WeGIA user (e.g., an institution staff member) via email or chat. When the victim opens the link, the unsanitized sql parameter is reflected into the response and executes in their browser, allowing session/cookie theft or actions in the WeGIA context. A public exploit exists in the GHSA advisory, lowering the skill required.