WeGIA hat Reflected Cross-Site Scripting (XSS) in `novo_memorandoo.php` über den `sccs` Parameter

The XSS vulnerability in WeGIA allows an attacker to execute malicious JavaScript code within the context of a user's browser session. This can lead to various attacks, including session hijacking, credential theft, and defacement of the WeGIA interface. An attacker could craft a malicious link containing the injected JavaScript payload and send it to a legitimate WeGIA user. Upon clicking the link, the JavaScript code would execute, granting the attacker control over the user's session. The potential impact extends to sensitive data managed within WeGIA, such as donor information, financial records, and beneficiary details, making this a high-risk vulnerability.

Charitable institutions and organizations using WeGIA version 3.6.6 or earlier are at significant risk. This includes organizations relying on WeGIA for managing donor information, financial records, and other sensitive data. Shared hosting environments where multiple organizations share the same WeGIA instance are particularly vulnerable, as a compromise of one organization could potentially impact others.

• generic web: Use curl to test the novomemorandoo.php endpoint with a simple JavaScript payload in the sccs parameter (e.g., curl 'http://wegia-instance/?novomemorandoo.php&sccs=<script>alert(1)</script>'). • generic web: Examine access and error logs for requests containing suspicious JavaScript code in the sccs parameter. • php: Review the novo_memorandoo.php file for the vulnerable code (line 273) and ensure proper sanitization/encoding of user input.

1. 2026-03-20Disclosure

   disclosure

1. Reserviert2026-03-17
2. Veröffentlicht2026-03-20
3. EPSS aktualisiert2026-03-27

The primary mitigation for CVE-2026-33135 is to immediately upgrade WeGIA to version 3.6.7 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds such as input validation and output encoding on the 'novo_memorandoo.php' endpoint. Web Application Firewalls (WAFs) configured to detect and block XSS payloads targeting GET parameters can also provide a layer of protection. Regularly review and update WeGIA's configuration to ensure adherence to security best practices.