GHSA-qm7p-cprp-f974: WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field
WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in saude/historicoprontuarios.php arises because the textoProntuario field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a patient's medical record can submit the field through POST /controle/control.php with nomeClasse=SaudeControle, metodo=alterarProntuario, and idfichamedica. The stored content is rendered when another user accesses /html/saude/historicoprontuarios.php with idhistorico, automatically executing attacker-controlled JavaScript in the victim's browser. The vulnerability permits session cookie theft and potential account compromise depending on the victim's privileges. This issue is fixed in version 3.8.7.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.8.7
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
WeGIA deployments running versions before 3.8.7 are affected. Users who view a medical-record history containing attacker-supplied content may have JavaScript executed in their browser.
What access does an attacker need to exploit it?
The attacker must be able to create or access a patient's medical record and submit a modified textoProntuario value through the medical-record update function. The malicious content is stored and executes when another user opens the associated history record.
Are users affected merely by viewing the record?
Yes. Accessing the medical history page for the affected id_historico renders the stored content, causing attacker-controlled JavaScript to execute automatically in the viewer's browser.
What is the remediation?
Upgrade WeGIA to version 3.8.7, which fixes the issue.