EUVD-2025-18681CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, an OS Command Injection vulnerability was identified in the /html/configuracao/debug_info.php endpoint. The branch parameter is not properly sanitized before being concatenated and executed in a shell command on the server's operating system. This flaw allows an unauthenticated attacker to execute arbitrary commands on the server with the privileges of the web server user (www-data). This issue has been patched in version 3.4.2.
AnalysisAI
Critical OS Command Injection vulnerability in WeGIA (a web management system for charitable institutions) versions prior to 3.4.2, affecting the /html/configuracao/debug_info.php endpoint. An unauthenticated attacker can inject arbitrary operating system commands via the unsanitized 'branch' parameter, achieving remote code execution (RCE) with www-data user privileges. With a CVSS score of 9.8 and network-based attack vector requiring no authentication or user interaction, this represents an immediate and severe threat to all unpatched WeGIA deployments.
Technical ContextAI
The vulnerability is rooted in CWE-78 (Improper Neutralization of Special Elements used in an OS Command, also known as OS Command Injection). WeGIA's debug_info.php script concatenates user-supplied input from the 'branch' parameter directly into a shell command executed via functions like exec(), system(), passthru(), or similar OS command invocation mechanisms without proper input validation or parameterization. The application fails to employ command-level input sanitization techniques (such as escapeshellarg() in PHP, parameterized command execution, or strict allowlisting of branch values). This permits shell metacharacters (|, &, ;, `, $(), etc.) to break out of the intended command context and execute attacker-controlled payloads with the privilege level of the web server process (typically www-data on Linux/Unix systems).
RemediationAI
Immediate actions: (1) Upgrade WeGIA to version 3.4.2 or later—this is the canonical patch and should be deployed as emergency priority. (2) If immediate patching is not possible, implement network-level mitigations: restrict HTTP/HTTPS access to /html/configuracao/debug_info.php using WAF rules, firewall ACLs, or reverse proxy configurations to block public access (allowlist only trusted internal IPs). (3) Disable or remove the debug_info.php endpoint entirely if not in active use (recommend backing up for audit purposes first). (4) Deploy input validation at the WAF or proxy layer to reject requests with shell metacharacters in the 'branch' parameter (e.g., block |, &, ;, `, $, parentheses, backticks). (5) Review logs for evidence of exploitation (look for encoded/obfuscated payloads in HTTP parameters or system command logs). (6) Monitor process execution for suspicious child processes spawned by the web server. Contact WeGIA vendor support for official advisory links and patch delivery mechanisms.
Share
External POC / Exploit Code
Leaving vuln.today