WeGIA hat Reflected Cross-Site Scripting (XSS) in `listar_memorandos_ativos.php` über den `sccd` Parameter

The XSS vulnerability in WeGIA allows an attacker to inject arbitrary JavaScript code into the HTML response when a user accesses the listarmemorandosativos.php endpoint with a malicious sccd parameter. This injected script can then execute in the user's browser, potentially stealing cookies, redirecting the user to a malicious website, or performing actions on their behalf. Successful exploitation could lead to account takeover and unauthorized access to sensitive data within the WeGIA system. The impact is amplified if the system manages sensitive financial or personal information for charitable donors or beneficiaries.

Charitable institutions using WeGIA versions 3.6.6 and earlier are at significant risk. Organizations relying on WeGIA for managing donor information or beneficiary data are particularly vulnerable, as a successful XSS attack could lead to data breaches and reputational damage. Shared hosting environments where multiple websites share the same server resources may also be affected if one website is compromised.

• php: Examine access logs for requests to /html/memorando/listarmemorandosativos.php containing unusual or obfuscated characters in the sccd GET parameter.

grep 'sccd=[a-zA-Z0-9><"\;]+' /var/log/apache2/access.log

• generic web: Use curl to test the endpoint with a simple XSS payload and observe the response.

curl 'http://wegia-server/html/memorando/listar_memorandos_ativos.php?sccd=<script>alert("XSS")</script>' 

• generic web: Check response headers for missing or incorrect Content-Security-Policy (CSP) directives, which could allow XSS attacks to succeed.

1. 2026-03-20Disclosure

   disclosure

1. Reserviert2026-03-17
2. Veröffentlicht2026-03-20
3. EPSS aktualisiert2026-03-27

The primary mitigation for CVE-2026-33136 is to immediately upgrade WeGIA to version 3.6.7 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious characters or patterns in the sccd parameter. Input validation and sanitization on the server-side for the sccd parameter can also help prevent the injection of malicious code. Thoroughly review and sanitize all user-supplied input before rendering it in the HTML response.