Vulnerability Report - XSS in documentos_funcionario.php parameter dados_addInfo

[nmmorette]

Vulnerability Description

A stored Cross-Site Scripting (XSS) vulnerability was identified in the WeGIA application. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious code is permanently stored on the server and executed whenever a compromised page is loaded, affecting all users accessing this page.

Location

The vulnerabilities were found in the following URLs:
html/geral/documentos_funcionario.php

Vulnerable Parameters: dados_addInfo

Impact

Exploitation of these vulnerabilities allows an attacker to inject and store malicious JavaScript code on the server, which will be executed for all users accessing the affected pages. This malicious code can:
Steal sensitive user information (e.g., session cookies, authentication tokens),
Redirect users to malicious sites,
Manipulate the application's interface, enabling phishing attacks and other social engineering techniques,
Compromise the application's integrity, causing potentially severe impacts to user experience and security.

Reproducing the Vulnerability

To reproduce the issue, insert the following payloads into the vulnerable field of the URL and save the changes:

<script>alert('Alert: XSS2');</script>

After saving the input, the injected script will be stored on the server and automatically executed for any user accessing the html/geral/documentos_funcionario.php, confirming the stored XSS.

Recommendations

To mitigate this vulnerability, it is recommended to:
Sanitize and Validate Inputs: Filter and escape all user inputs, especially in the fields endpoint, name, token, and nome.
Output Encoding: Ensure all stored data is properly encoded before being rendered in the HTML response.
Content Security Policy (CSP): Implement a Content Security Policy to restrict script execution to trusted sources.

Reference

For more details on XSS and mitigation strategies, please refer to the OWASP XSS Prevention Cheat Sheet.

POC

File: documentos_funcionario.php
Payload: <script>alert('Alert: XSS2');</script>
Trigger in: funcionario/profile_funcionario.php?id_funcionario=1
Endpoint: dados_addInfo