What is the CVSS score of CVE-2025-52474?

CVE-2025-52474 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-52474?

A critical SQL injection vulnerability in WeGIA (version <3.4.2) allows attackers to extract sensitive donor, beneficiary, and operational data from charitable institutions' databases.. A patch is available.

Is there a public PoC exploit available for CVE-2025-52474?

Yes, a public proof-of-concept exploit is available for CVE-2025-52474. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-52474?

Within 24 hours: Identify all systems running WeGIA and their versions; isolate or restrict external access to affected instances if patching cannot be completed immediately. Within 7 days: Apply vendor patch to upgrade all WeGIA installations to version 3.4.2 or later. Within 30 days: Conduct database audit to confirm no unauthorized access occurred; review access logs for suspicious activity targeting the /WeGIA/controle/control.php endpoint; document remediation completion for compliance records.

PHP CVE-2025-52474

Q: Is there a public PoC exploit available for CVE-2025-52474?

Yes, a public proof-of-concept exploit is available for CVE-2025-52474. Prioritise patching immediately. EPSS: 0.1%.

Q: How to fix or mitigate CVE-2025-52474?

Within 24 hours: Identify all systems running WeGIA and their versions; isolate or restrict external access to affected instances if patching cannot be completed immediately. Within 7 days: Apply vendor patch to upgrade all WeGIA installations to version 3.4.2 or later. Within 30 days: Conduct database audit to confirm no unauthorized access occurred; review access logs for suspicious activity targeting the /WeGIA/controle/control.php endpoint; document remediation completion for compliance records.

EUVD-2025-18678 CRITICAL

SQL Injection (CWE-89)

2025-06-19 security-advisories@github.com

PHP SQLi Information Disclosure Wegia

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 00:08 euvd

EUVD-2025-18678

Analysis Generated

Mar 15, 2026 - 00:08 vuln.today

Patch released

Mar 15, 2026 - 00:08 nvd

Patch available

PoC Detected

Jul 02, 2025 - 16:18 vuln.today

Public exploit code

CVE Published

Jun 19, 2025 - 04:15 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, a SQL Injection vulnerability was identified in the id parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data. This issue has been patched in version 3.4.2.

AnalysisAI

Critical SQL Injection vulnerability in WeGIA (a web-based management system for charitable institutions) affecting the 'id' parameter of the /WeGIA/controle/control.php endpoint in versions prior to 3.4.2. This unauthenticated, network-accessible vulnerability enables attackers to execute arbitrary SQL queries without privileges or user interaction, resulting in complete compromise of database confidentiality, integrity, and availability. The CVSS 9.8 score reflects the severe impact potential; however, KEV status, EPSS probability, and public POC availability could not be confirmed from provided data and should be verified through CISA and exploit databases.

Technical ContextAI

WeGIA is a PHP-based web application framework for non-profit/charitable institution management. The vulnerability exists in the control.php endpoint's insufficient input validation on the 'id' parameter, allowing unsanitized user input to be concatenated into SQL query strings. This is a classic SQL Injection flaw (CWE-89: Improper Neutralization of Special Elements used in an SQL Command), where an attacker can inject SQL metacharacters (e.g., single quotes, UNION statements, comments) to alter query logic. The root cause is the absence of parameterized queries or prepared statements, combined with lack of input sanitization. Affected systems typically run PHP with MySQL/MariaDB backends. The /controle/control.php endpoint likely handles data retrieval/manipulation for administrative functions, making it a high-value attack surface.

RemediationAI

IMMEDIATE: (1) Upgrade WeGIA to version 3.4.2 or later. Verify patch application by checking version strings and deployment artifacts. (2) If immediate patching is not feasible, implement compensating controls: (a) Web Application Firewall (WAF) rules to block SQL injection payloads in the 'id' parameter (e.g., regex rules for UNION, SELECT, comment syntax). (b) Network-level access restrictions: limit access to /WeGIA/controle/control.php to trusted IP ranges or require VPN. (c) Database-level hardening: use database accounts with minimal privileges; implement row-level security. (3) Post-patch: validate remediation by testing the id parameter with known SQL injection payloads (e.g., 'id=1 OR 1=1--'); responses should not reveal database errors or unexpected data. (4) Review WeGIA security advisories at vendor support portal for any additional patches or related issues.