CVE-2024-57034
📋 TL;DR
CVE-2024-57034 is a critical SQL injection vulnerability in WeGIA versions before 3.2.0 that allows attackers to execute arbitrary SQL commands through the query parameter in query_geracao_auto.php. This affects all organizations using vulnerable WeGIA installations, potentially exposing sensitive database information. Attackers can manipulate database queries to extract, modify, or delete data.
💻 Affected Systems
- WeGIA
📦 What is this software?
Wegia by Wegia
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, data destruction, or full system takeover via subsequent attacks.
Likely Case
Unauthorized data access and extraction of sensitive information from the database.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing exploitation.
🎯 Exploit Status
The vulnerability is in a publicly accessible PHP file and requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.0
Vendor Advisory: https://www.wegia.org
Restart Required: No
Instructions:
1. Download WeGIA version 3.2.0 or later from the official website. 2. Backup your current installation and database. 3. Replace the vulnerable query_geracao_auto.php file with the patched version. 4. Verify the fix by testing the vulnerable parameter.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the query parameter before processing
Modify query_geracao_auto.php to add: $query = filter_var($_GET['query'], FILTER_SANITIZE_STRING);
Access Restriction
linuxRestrict access to query_geracao_auto.php file
Add to .htaccess: <Files "query_geracao_auto.php">
Order Deny,Allow
Deny from all
</Files>
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns
- Isolate the WeGIA application in a segmented network zone with restricted database access
🔍 How to Verify
Check if Vulnerable:
Test the query_geracao_auto.php endpoint with SQL injection payloads like: query_geracao_auto.php?query=1' OR '1'='1Check Version:
Check WeGIA version in admin panel or read version.txt file in installation directoryVerify Fix Applied:
Attempt the same SQL injection test after patching; successful fix should return error or no data manipulation📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts following SQL patterns
- Access to query_geracao_auto.php with suspicious parameters
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, etc.) to query_geracao_auto.php
- Unusual database connection patterns from web server
SIEM Query:
source="web_logs" AND uri="*query_geracao_auto.php*" AND (query="*' OR*" OR query="*UNION*" OR query="*SELECT*" OR query="*--*")