EUVD-2025-21404CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Versions prior to 3.4.5 have a SQL Injection vulnerability in the endpoint `/WeGIA/html/socio/sistema/processa_deletar_socio.php`, in the `id_socio` parameter. This vulnerability allows the execution of arbitrary SQL commands, which can compromise the confidentiality, integrity, and availability of stored data. Version 3.4.5 fixes the issue.
Analysis
WeGIA versions prior to 3.4.5 contain a SQL Injection vulnerability in the member deletion endpoint that allows authenticated users to execute arbitrary SQL commands via the id_socio parameter. This high-severity vulnerability (CVSS 8.8) compromises the confidentiality, integrity, and availability of the entire database. The vulnerability requires valid credentials to exploit but offers complete database compromise once authenticated.
Technical Context
The vulnerability exists in `/WeGIA/html/socio/sistema/processa_deletar_socio.php`, a PHP-based endpoint designed to delete member records. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that user-supplied input in the `id_socio` parameter is directly concatenated into SQL queries without proper parameterization or input validation. WeGIA is a Portuguese-language web management system tailored for charitable institutions (NGOs, social organizations), making the affected user base primarily non-profit entities managing member databases. The lack of prepared statements or input sanitization allows attackers to inject SQL metacharacters and execute arbitrary database commands.
Affected Products
Product: WeGIA (Open Source Web Manager for Portuguese language and charitable institutions). Affected versions: All versions prior to 3.4.5. Fixed version: 3.4.5 and later. CPE string (estimated): cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:* (versions <3.4.5). Specific endpoint: /WeGIA/html/socio/sistema/processa_deletar_socio.php. Vulnerable parameter: id_socio. No vendor advisory links or references were provided in the source data; verification and patch details should be obtained from the official WeGIA GitHub repository or project website.
Remediation
Immediate remediation: (1) Upgrade WeGIA to version 3.4.5 or later, which contains the fix for this SQL Injection vulnerability; (2) Short-term mitigation for unpatched systems: Implement Web Application Firewall (WAF) rules to block SQL metacharacters in the id_socio parameter (filter single quotes, double quotes, semicolons, and SQL keywords like UNION, SELECT, DROP); (3) Apply principle of least privilege to database accounts used by WeGIA—limit to SELECT, INSERT, UPDATE, DELETE only on necessary tables; (4) Restrict access to the /WeGIA/html/socio/sistema/ endpoint using network-level access controls to trusted administrators; (5) Enable database query logging and audit logs to detect exploitation attempts; (6) For long-term security: Ensure all user input is validated against a strict allowlist (id_socio should be numeric only), use parameterized queries/prepared statements in all PHP code, and implement code review processes for SQL-generating functions.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today