EUVD-2025-18681CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Tags
Description
WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, an OS Command Injection vulnerability was identified in the /html/configuracao/debug_info.php endpoint. The branch parameter is not properly sanitized before being concatenated and executed in a shell command on the server's operating system. This flaw allows an unauthenticated attacker to execute arbitrary commands on the server with the privileges of the web server user (www-data). This issue has been patched in version 3.4.2.
Analysis
Critical OS Command Injection vulnerability in WeGIA (a web management system for charitable institutions) versions prior to 3.4.2, affecting the /html/configuracao/debug_info.php endpoint. An unauthenticated attacker can inject arbitrary operating system commands via the unsanitized 'branch' parameter, achieving remote code execution (RCE) with www-data user privileges. With a CVSS score of 9.8 and network-based attack vector requiring no authentication or user interaction, this represents an immediate and severe threat to all unpatched WeGIA deployments.
Technical Context
The vulnerability is rooted in CWE-78 (Improper Neutralization of Special Elements used in an OS Command, also known as OS Command Injection). WeGIA's debug_info.php script concatenates user-supplied input from the 'branch' parameter directly into a shell command executed via functions like exec(), system(), passthru(), or similar OS command invocation mechanisms without proper input validation or parameterization. The application fails to employ command-level input sanitization techniques (such as escapeshellarg() in PHP, parameterized command execution, or strict allowlisting of branch values). This permits shell metacharacters (|, &, ;, `, $(), etc.) to break out of the intended command context and execute attacker-controlled payloads with the privilege level of the web server process (typically www-data on Linux/Unix systems).
Affected Products
WeGIA versions prior to 3.4.2 are affected. Based on the CVE description, the vulnerable component is specifically: /html/configuracao/debug_info.php (the debug_info endpoint in the configuracao module). The vulnerability applies to any deployment running WeGIA < 3.4.2 regardless of hosting environment (shared hosting, dedicated servers, cloud platforms). No CPE string was provided in the source data, but the affected product family would be: WeGIA Web Manager for Charitable Institutions, all versions before 3.4.2. Vendors or operators should check version numbers via application headers, footer credits, or backend version files (often in /VERSION, /version.txt, or package manifests). The vulnerability is introduced in the application logic itself and is therefore present in all default and custom installations of vulnerable versions.
Remediation
Immediate actions: (1) Upgrade WeGIA to version 3.4.2 or later—this is the canonical patch and should be deployed as emergency priority. (2) If immediate patching is not possible, implement network-level mitigations: restrict HTTP/HTTPS access to /html/configuracao/debug_info.php using WAF rules, firewall ACLs, or reverse proxy configurations to block public access (allowlist only trusted internal IPs). (3) Disable or remove the debug_info.php endpoint entirely if not in active use (recommend backing up for audit purposes first). (4) Deploy input validation at the WAF or proxy layer to reject requests with shell metacharacters in the 'branch' parameter (e.g., block |, &, ;, `, $, parentheses, backticks). (5) Review logs for evidence of exploitation (look for encoded/obfuscated payloads in HTTP parameters or system command logs). (6) Monitor process execution for suspicious child processes spawned by the web server. Contact WeGIA vendor support for official advisory links and patch delivery mechanisms.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today