CVE-2025-26605
📋 TL;DR
A SQL injection vulnerability in WeGIA's deletar_cargo.php endpoint allows authenticated attackers to execute arbitrary SQL queries. This could lead to unauthorized access to sensitive database information. All WeGIA users running versions before 3.2.13 are affected.
💻 Affected Systems
- WeGIA
📦 What is this software?
Wegia by Wegia
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including exfiltration of all sensitive data, privilege escalation, and potential system takeover.
Likely Case
Unauthorized access to sensitive user data, organizational information, and potential data manipulation.
If Mitigated
Limited impact with proper input validation and database permission restrictions in place.
🎯 Exploit Status
Requires authentication but SQL injection is a well-understood attack vector
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.13
Vendor Advisory: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6gv7-4j8g-cvgp
Restart Required: No
Instructions:
1. Backup your current WeGIA installation and database. 2. Download WeGIA version 3.2.13 from the official repository. 3. Replace the vulnerable files with the patched version. 4. Verify the update was successful.
🔧 Temporary Workarounds
No official workarounds
allThe vendor states there are no known workarounds for this vulnerability
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries at the application layer
- Restrict database user permissions to minimum required privileges
🔍 How to Verify
Check if Vulnerable:
Check if deletar_cargo.php exists in your WeGIA installation and verify the version is below 3.2.13Check Version:
Check WeGIA version in the application interface or configuration filesVerify Fix Applied:
Verify the version is 3.2.13 or higher and check that deletar_cargo.php has proper input validation📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed authentication attempts followed by deletar_cargo.php access
Network Indicators:
- Unusual patterns of requests to deletar_cargo.php endpoint
SIEM Query:
source="web_logs" AND uri="*deletar_cargo.php*" AND (query="*SELECT*" OR query="*UNION*" OR query="*OR 1=1*")