WeGIA CVE-2025-61603

Requires a valid authenticated WeGIA session (CVSS PR:L) with access to the product-registration workflow that posts to /controle/control.php. The injectable input is the descricao parameter, which in vulnerable versions (<= 3.4.12) is concatenated directly into a SELECT ... WHERE descricao='...' query with no parameter binding. No user interaction beyond the attacker's own request and no non-default configuration is needed; the limiting factor is the authentication requirement - an unauthenticated outsider cannot reach the vulnerable endpoint. Fixed in 3.5.0 via FILTER_SANITIZE_SPECIAL_CHARS on input and PDO prepared statements.

Signals are consistent but point to a contained, lower-urgency issue despite the high score. The CVSS 4.0 base score of 9.4 (CRITICAL) reflects an authenticated SQL injection with full CIA impact (VC:H/VI:H/VA:H) over the network (AV:N/AC:L/PR:L/UI:N), and the vendor commit confirms the root cause - unsanitized string concatenation of the descricao value into a raw SQL query in dao/ProdutoDAO.php, fixed by switching to prepared statements with bound parameters. However, real-world exploitation signals are weak: EPSS is only 0.03% (9th percentile), there is NO CISA KEV listing, and the vulnerability requires valid authentication (PR:L). A public exploit path exists only as the GitHub Security Advisory (GHSA-v8hm-pq8g-c7j4), not a weaponized exploit kit. The practical risk is therefore moderate rather than emergency-tier: the flaw is genuine and fully confirmed by source code, but it needs an authenticated account and affects a niche product with a tiny deployment footprint, which explains the very low EPSS. Note the one nuance: PR:L requires an attacker to already hold a low-privilege application account, so this is more realistically an insider/privilege-escalation-of-data-access scenario than mass opportunistic exploitation.

An attacker holding a low-privilege WeGIA account submits a crafted descricao value to /controle/control.php; because the value was concatenated directly into a SELECT query, the injected SQL executes against the database. A public GitHub Security Advisory documents the flaw, and the fixing commit confirms the exact unparameterized query, so reproducing the injection is straightforward for anyone with account access.