CVE-2025-26606
📋 TL;DR
A SQL injection vulnerability in WeGIA's informacao_adicional.php endpoint allows attackers to execute arbitrary SQL queries. This could lead to unauthorized access to sensitive database information. All WeGIA users running vulnerable versions are affected.
💻 Affected Systems
- WeGIA
📦 What is this software?
Wegia by Wegia
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including exfiltration of all sensitive data, authentication bypass, and potential remote code execution through database functions.
Likely Case
Data theft of sensitive information stored in the database, including user credentials, personal information, and institutional data.
If Mitigated
Limited impact if proper input validation and WAF rules are in place, though SQL injection could still bypass some controls.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited and tooling exists for automated exploitation
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.13
Vendor Advisory: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-rxjr-cw9q-cwwg
Restart Required: Yes
Instructions:
1. Backup your current WeGIA installation and database
2. Download WeGIA version 3.2.13 or later from the official repository
3. Replace the existing installation with the updated version
4. Restart the web server service
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with SQL injection rules
- Restrict access to the informacao_adicional.php endpoint using network controls
🔍 How to Verify
Check if Vulnerable:
Check if informacao_adicional.php exists in your WeGIA installation and examine the code for proper input sanitizationCheck Version:
Check the WeGIA version in the application interface or configuration filesVerify Fix Applied:
Verify the version is 3.2.13 or higher and test the informacao_adicional.php endpoint with SQL injection test payloads📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web server logs
- Multiple requests to informacao_adicional.php with SQL keywords in parameters
Network Indicators:
- HTTP requests containing SQL injection patterns targeting the vulnerable endpoint
SIEM Query:
web.url:*informacao_adicional.php* AND (web.query:*UNION* OR web.query:*SELECT* OR web.query:*INSERT* OR web.query:*UPDATE* OR web.query:*DELETE*)