CVE-2025-24957
📋 TL;DR
This SQL injection vulnerability in WeGIA's get_detalhes_socio.php endpoint allows authenticated attackers to execute arbitrary SQL queries. Attackers could read, modify, or delete sensitive database information including donor records, financial data, and personal information. All WeGIA installations before version 3.2.12 are affected.
💻 Affected Systems
- WeGIA (Web Manager for Charitable Institutions)
📦 What is this software?
Wegia by Wegia
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive donor information, financial records, and organizational data with potential data exfiltration.
If Mitigated
Limited impact due to proper input validation, parameterized queries, and database permission restrictions.
🎯 Exploit Status
SQL injection vulnerabilities are commonly weaponized. Requires authenticated access but exploitation is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.12
Vendor Advisory: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x28g-6228-99p9
Restart Required: No
Instructions:
1. Backup your database and application files. 2. Download WeGIA version 3.2.12 from the official repository. 3. Replace existing files with patched version. 4. Verify functionality.
🔧 Temporary Workarounds
No official workarounds
allVendor states no workarounds exist. Immediate patching is required.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WeGIA from sensitive systems.
- Deploy a web application firewall (WAF) with SQL injection protection rules.
🔍 How to Verify
Check if Vulnerable:
Check if get_detalhes_socio.php exists in your WeGIA installation and review version number.Check Version:
grep -r 'version' WeGIA/configuration/ files or check admin dashboardVerify Fix Applied:
Verify version is 3.2.12 or later by checking the application version in admin panel or source files.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed authentication attempts followed by SQL queries
- Unusual database query patterns from application user
Network Indicators:
- SQL syntax in HTTP POST/GET parameters to get_detalhes_socio.php
- Unusual database connection patterns
SIEM Query:
source="wegia_logs" AND ("SQL syntax" OR "get_detalhes_socio.php" AND (UNION SELECT OR "--" OR "' OR "))