CVE-2026-61673: WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover
WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in web/html/memorando/listardespachos.php results from unsafe handling of the texto field. The affected flow spans web/controle/memorando/DespachoControle.php and web/dao/memorando/DespachoDAO.php: FILTERSANITIZESPECIALCHARS is applied during storage, but htmlentitydecode() later decodes the stored content and jQuery .html() inserts the result into the DOM. An attacker able to submit a memorandum dispatch through /controle/control.php using DespachoControle and metodo=incluir can store malicious HTML or JavaScript. The code executes automatically when another user views the memorandum thread through /html/memorando/listardespachos.php with idmemorando. This permits arbitrary JavaScript execution, theft of administrator PHPSESSID session tokens, privileged session hijacking, account takeover, and unauthorized access to privileged or internal functionality. This issue is fixed in version 3.8.7.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.8.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
WeGIA deployments running versions before 3.8.7 are affected when users can submit memorandum dispatches. Users who view a malicious memorandum thread are exposed to JavaScript executing in their authenticated browser session, including administrators.
What does an attacker need to exploit it?
The attacker needs the ability to submit a memorandum dispatch through /controle/control.php using DespachoControle with metodo=incluir. They can place malicious content in the texto field, which is stored and later rendered in the memorandum thread.
Does exploitation require a victim to take an action?
Yes. The stored payload executes automatically when another user views the affected memorandum thread through /html/memorando/listar_despachos.php with id_memorando. No additional interaction beyond opening the thread is described.
How can I determine whether my deployment may be affected?
Check whether the installed WeGIA version is earlier than 3.8.7. Also review memorandum dispatch records for untrusted or unexpected HTML or JavaScript in the texto field, especially in threads viewed by privileged users.
What should be done if patching cannot happen immediately?
No interim mitigation is provided in the available data. Prioritize preventing untrusted users from submitting memorandum dispatches and limit access to affected memorandum threads until the deployment can be updated to 3.8.7.