CVE-2025-26617
📋 TL;DR
A SQL injection vulnerability in WeGIA's historico_paciente.php endpoint allows attackers to execute arbitrary SQL queries. This could lead to unauthorized access to sensitive patient and institutional data. All WeGIA users running vulnerable versions are affected.
💻 Affected Systems
- WeGIA
📦 What is this software?
Wegia by Wegia
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including patient records, user credentials, and sensitive institutional data, potentially leading to data breach, system takeover, or data destruction.
Likely Case
Extraction of sensitive patient information and user credentials, leading to privacy violations and potential lateral movement within the system.
If Mitigated
Limited data exposure if proper input validation and database permissions are in place, but SQL injection still poses significant risk.
🎯 Exploit Status
SQL injection vulnerabilities are typically easy to exploit with basic web security testing tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.14
Vendor Advisory: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-f654-c5r5-jx77
Restart Required: No
Instructions:
1. Backup your current WeGIA installation and database. 2. Download WeGIA version 3.2.14 from the official repository. 3. Replace the vulnerable files with the patched version. 4. Verify the historico_paciente.php endpoint is updated.
🔧 Temporary Workarounds
No official workarounds
allThe vendor states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with SQL injection protection rules
- Restrict network access to the WeGIA application to only trusted IP addresses
🔍 How to Verify
Check if Vulnerable:
Check if your WeGIA version is below 3.2.14 by examining the application version in the admin interface or configuration files.Check Version:
Check WeGIA configuration files or admin dashboard for version information.Verify Fix Applied:
Verify the application version shows 3.2.14 or higher, and test the historico_paciente.php endpoint with SQL injection test payloads (in a controlled environment).📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or unusual parameter values in web server logs for historico_paciente.php
Network Indicators:
- Unusual traffic patterns to the historico_paciente.php endpoint
- SQL error messages in HTTP responses
SIEM Query:
source="web_server" AND uri="/historico_paciente.php" AND (param="*' OR '1'='1*" OR param="*;--*" OR param="*UNION SELECT*" OR status=500)