WeGIA Reflected Cross-Site Scripting Vulnerability in the 'idatendido' Parameter of 'cadastro_atendido_parentesco_pessoa_nova.php' Endpoint

A reflected cross-site scripting vulnerability has been identified in the WeGIA application, prior to version 3.5.1. The issue is present in the '/html/atendido/cadastro_atendido_parentesco_pessoa_nova.php' endpoint, where the 'idatendido' parameter is not properly validated or sanitized. This allows attackers to inject malicious scripts that are executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for the execution of arbitrary JavaScript in the victim's browser. This could lead to session theft, account takeover, or unauthorized actions performed on behalf of the user.

Reproduction

To reproduce this vulnerability, log into the WeGIA application and navigate to the 'cadastro_atendido_parentesco_pessoa_nova.php' endpoint. Inject a script payload into the 'idatendido' parameter. The injected script will be executed in the context of the user's browser, demonstrating the cross-site scripting vulnerability.

Remediation

Users can update to WeGIA version 3.5.1 or later, where this vulnerability has been patched.