WeGIA CVE-2025-62177

Exploitation requires an authenticated WeGIA session: the vulnerable endpoint /html/funcionario/dependente_listar.php first checks for a valid $_SESSION["usuario"] and enforces a permission check via permissao.php (confirmed in the patch diff), so the attacker must hold a logged-in account with access to the employee-dependents feature. Given that gate, an authorized or account-compromised user can inject arbitrary SQL through the id_funcionario POST parameter against any WeGIA instance prior to 3.5.1 in its default configuration (no special non-default setting is needed beyond having the feature/account). The primary limiting factor is the required privilege level (PR:H) and valid authentication; there is no user-interaction requirement and no platform-specific constraint beyond running a PHP/WeGIA deployment older than 3.5.1.

This is a genuine but conditionally-gated vulnerability rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC/VI/VA:H, score 8.6) indicates a network-reachable, low-complexity SQL injection with full confidentiality, integrity, and availability impact on the database, but critically it requires high privileges (PR:H) - the endpoint checks for an authenticated session ($_SESSION["usuario"]) and a permission gate (permissao.php), confirmed by the patch diff. This means it is NOT a remote-unauthenticated flaw; an attacker must already hold a valid, permissioned account. Exploitation signals are mixed: publicly available exploit code exists (GHSA-4wrg-g9cj-hjcx), which raises practical risk, but EPSS is low at 0.53% (43rd percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active in-the-wild exploitation. The low EPSS is consistent with the authentication requirement and the product's niche footprint, suggesting the real-world threat is limited to insider/compromised-account scenarios rather than mass opportunistic attacks. Priority is moderate: patch promptly for any WeGIA deployment, but the PR:H gate materially reduces exposure compared to a raw 8.6 score read in isolation.

An attacker who already holds an authenticated WeGIA account with employee-view permissions sends a crafted POST request to /html/funcionario/dependente_listar.php with a malicious id_funcionario value, injecting SQL into the unparameterized query. Because public exploit code exists in the GitHub security advisory, a low-skill authenticated or account-compromised attacker can dump or tamper with the entire database (person records, CPFs, employee data). The network attack vector and low complexity make the request trivial to deliver once a session is obtained.