WeGIA Cross-Site Scripting Vulnerability in Documentos Funcionario PHP

A stored cross-site scripting (XSS) vulnerability exists in WeGIA versions prior to 3.2.0. The issue arises in the 'dados_addInfo' parameter of 'documentos_funcionario.php', allowing unauthorized scripts to be executed in the user's browser. This vulnerability is particularly severe as the injected script is permanently stored on the server and executed for all users accessing the compromised page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user’s browser whenever the affected page is loaded.

Reproduction

To reproduce this vulnerability, insert a script payload into the 'dados_addInfo' parameter of 'documentos_funcionario.php' and save the changes. The injected script will be executed for any user accessing 'funcionario/profile_funcionario.php?id_funcionario=1', confirming the presence of stored XSS.