WeGIA CVE-2025-62179

Exploitation requires an authenticated session with high privileges (CVSS PR:H) - typically an administrative WeGIA account with access to the employee-registration workflow - and network reachability to the application (AV:N, AC:L, no user interaction). The specific attack surface is the cpf parameter of /html/funcionario/cadastro_funcionario_pessoa_existente.php, which in versions prior to 3.5.1 concatenates the value directly into SQL queries against the pessoa and funcionario tables. The key limiting factor is the privileged-authentication prerequisite: this is not exploitable by anonymous or low-privileged users, so realistic risk is scoped to attackers who have already obtained admin credentials or to privilege-abuse/insider scenarios. No special non-default configuration is otherwise needed on affected (pre-3.5.1) installations.

This is a genuine CVSS 4.0 8.6 (High) SQL injection (CWE-89) in WeGIA's /html/funcionario/cadastro_funcionario_pessoa_existente.php endpoint via the cpf parameter, with full VC:H/VI:H/VA:H impact confirmed by the vendor's source-code fix (raw $cpf string concatenation replaced with PDO prepared statements and bindParam in the patch commit). However, the raw severity is substantially tempered by real-world signals: the CVSS 4.0 vector specifies PR:H, meaning exploitation requires high-privilege (administrative) authentication, and the affected endpoint is an internal employee-registration function. EPSS is low at 0.43% (35th percentile), there is NO CISA KEV listing (no confirmed active exploitation), and while publicly available exploit code exists (via the GitHub Security Advisory), POC availability is a distinct signal from in-the-wild use. Net assessment: a legitimate database-compromise bug worth patching, but not an internet-facing unauthenticated emergency - the PR:H requirement and niche product footprint make this a moderate, patch-in-normal-cycle priority rather than a widespread mass-exploitation threat. No major conflicts in the data; the primary caveat is that PR:H indicates the attacker must already hold a privileged account.

An authenticated WeGIA user with high (administrative) privileges submits a crafted value in the cpf parameter to the cadastro_funcionario_pessoa_existente.php endpoint, where it is concatenated directly into SQL queries against the pessoa/funcionario tables. By injecting SQL syntax, the attacker reads, modifies, or destroys arbitrary database contents, breaching confidentiality, integrity, and availability. Publicly available exploit code (referenced in the GitHub Security Advisory GHSA-x36x-x5j4-wfjf) lowers the skill barrier, though the network vector is gated behind privileged authentication.