WeGIA Stored Cross-Site Scripting Vulnerability in 'adicionar_enfermidade.php' Endpoint

A stored cross-site scripting vulnerability has been identified in the WeGIA application, specifically in the 'adicionar_enfermidade.php' endpoint, prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts into the 'nome' parameter. The injected scripts are stored on the server and executed automatically when the affected page is accessed by users, posing a significant security risk. Version 3.4.5 addresses this issue.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user accessing the page. This could lead to session hijacking, credential theft, and other impacts associated with cross-site scripting vulnerabilities.

Reproduction

To reproduce this vulnerability, send a POST request to the 'adicionar_enfermidade.php' endpoint with a script payload in the 'nome' parameter. The injected script will be executed when the page is accessed by users.

Remediation

Users can update to WeGIA version 3.4.5 or later, where this vulnerability has been fixed.