CVE-2025-61603
📋 TL;DR
CVE-2025-61603 is a critical SQL injection vulnerability in WeGIA web management software for charitable institutions. Attackers can execute arbitrary SQL commands through the /controle/control.php endpoint's descricao parameter, potentially compromising the entire database. Organizations running WeGIA versions 3.4.12 and below are affected.
💻 Affected Systems
- WeGIA (Web manager for charitable institutions)
📦 What is this software?
Wegia by Wegia
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, deletion of all records, and potential server takeover via database server exploitation.
Likely Case
Unauthorized access to sensitive donor information, financial records, and personal data of beneficiaries, with potential data exfiltration or modification.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permissions restricting damage to specific tables.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited with readily available tools like sqlmap. The advisory provides enough detail for attackers to craft exploits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.5.0
Vendor Advisory: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v8hm-pq8g-c7j4
Restart Required: No
Instructions:
1. Backup your current WeGIA installation and database. 2. Download version 3.5.0 from the official repository. 3. Replace the vulnerable files with the patched version. 4. Verify the fix by checking that the descricao parameter now uses parameterized queries.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the /controle/control.php endpoint and descricao parameter.
Input Validation Filter
allAdd server-side input validation to reject SQL keywords and special characters in the descricao parameter.
🧯 If You Can't Patch
- Implement network segmentation to isolate the WeGIA server from sensitive systems and restrict access to trusted IPs only.
- Enable detailed logging and monitoring for suspicious SQL queries and implement database user privilege reduction.
🔍 How to Verify
Check if Vulnerable:
Check if your WeGIA version is 3.4.12 or below by examining the software version in the admin interface or configuration files.Check Version:
Check the WeGIA configuration files or admin dashboard for version information. No single command exists for all installations.Verify Fix Applied:
After patching, test the /controle/control.php endpoint with SQL injection payloads in the descricao parameter to ensure they are properly sanitized or rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts or parameter manipulation in access logs
- Suspicious SQL keywords (UNION, SELECT, INSERT, DROP) in POST parameters
Network Indicators:
- Unusual database connection patterns from web server
- Large data transfers from database server
SIEM Query:
source="wegia_logs" AND ("SQL syntax" OR "You have an error in your SQL syntax" OR "descricao" AND ("UNION" OR "SELECT" OR "INSERT" OR "DROP"))