WeGIA Clickjacking Vulnerability

A clickjacking vulnerability has been identified in WeGIA, a web management application for charitable institutions, in versions prior to 3.6.2. The application lacks proper HTTP headers to protect against framing attacks, specifically missing the X-Frame-Options header and not configuring the Content-Security-Policy to restrict frame ancestors. This absence allows attackers to embed WeGIA pages within malicious HTML documents, overlay deceptive elements, conceal genuine buttons, or inadvertently trigger interactions with sensitive processes.

Impact

Exploitation of this vulnerability allows for clickjacking attacks, where users can be manipulated into interacting with the application in unintended ways, potentially leading to unauthorized actions or disclosure of sensitive information.

Remediation

Users can update to WeGIA version 3.6.2 or later, where this vulnerability has been fixed. Instructions for downloading the latest version are available on the WeGIA GitHub releases page.