EUVD-2025-21404CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionNVD
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Versions prior to 3.4.5 have a SQL Injection vulnerability in the endpoint /WeGIA/html/socio/sistema/processa_deletar_socio.php, in the id_socio parameter. This vulnerability allows the execution of arbitrary SQL commands, which can compromise the confidentiality, integrity, and availability of stored data. Version 3.4.5 fixes the issue.
AnalysisAI
WeGIA versions prior to 3.4.5 contain a SQL Injection vulnerability in the member deletion endpoint that allows authenticated users to execute arbitrary SQL commands via the id_socio parameter. This high-severity vulnerability (CVSS 8.8) compromises the confidentiality, integrity, and availability of the entire database. The vulnerability requires valid credentials to exploit but offers complete database compromise once authenticated.
Technical ContextAI
The vulnerability exists in /WeGIA/html/socio/sistema/processa_deletar_socio.php, a PHP-based endpoint designed to delete member records. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that user-supplied input in the id_socio parameter is directly concatenated into SQL queries without proper parameterization or input validation. WeGIA is a Portuguese-language web management system tailored for charitable institutions (NGOs, social organizations), making the affected user base primarily non-profit entities managing member databases. The lack of prepared statements or input sanitization allows attackers to inject SQL metacharacters and execute arbitrary database commands.
RemediationAI
Immediate remediation: (1) Upgrade WeGIA to version 3.4.5 or later, which contains the fix for this SQL Injection vulnerability; (2) Short-term mitigation for unpatched systems: Implement Web Application Firewall (WAF) rules to block SQL metacharacters in the id_socio parameter (filter single quotes, double quotes, semicolons, and SQL keywords like UNION, SELECT, DROP); (3) Apply principle of least privilege to database accounts used by WeGIA—limit to SELECT, INSERT, UPDATE, DELETE only on necessary tables; (4) Restrict access to the /WeGIA/html/socio/sistema/ endpoint using network-level access controls to trusted administrators; (5) Enable database query logging and audit logs to detect exploitation attempts; (6) For long-term security: Ensure all user input is validated against a strict allowlist (id_socio should be numeric only), use parameterized queries/prepared statements in all PHP code, and implement code review processes for SQL-generating functions.
Share
External POC / Exploit Code
Leaving vuln.today