The WeGIA application, a web manager for charitable institutions, contains an Open Redirect vulnerability in versions before 3.6.9. Specifically, the /WeGIA/controle/control.php endpoint improperly handles the nextPage parameter combined with metodo=listarId and nomeClasse=IentradaControle, failing to validate or restrict redirection targets. This allows attackers to craft URLs that redirect users to untrusted external websites, potentially enabling phishing and other social engineering attacks. The issue is addressed in WeGIA version 3.6.9.

Successful exploitation allows attackers to redirect users from the legitimate WeGIA domain to arbitrary external websites. This can be abused for phishing, credential theft, malware distribution, and social engineering attacks. The CVSS 4.0 score of 5.1 reflects a medium severity with network attack vector, low complexity, no privileges required, and user interaction needed.

Upgrade WeGIA to version 3.6.9 or later, where this Open Redirect vulnerability is fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. Patch status is confirmed fixed in 3.6.9. No additional mitigations are specified.