WeGIA CVE-2025-62360

Exploitation requires an authenticated session to WeGIA: the endpoint /html/funcionario/dependente_documento.php checks $_SESSION['usuario'] and includes permissao.php before processing, so an attacker needs valid credentials or a hijacked session (consistent with CVSS PR:H/PR:L, not PR:N). Given that gate, no further special configuration is needed - any WeGIA deployment prior to 3.5.1 is affected in its default state, and the attacker simply sends a POST request with a malicious id_dependente value. The main limiting factors are the authentication requirement and the product's very small deployment base; there is no user-interaction requirement (UI:N) and attack complexity is low (AC:L).

This is a genuine high-severity SQL injection (CWE-89) with strong source-code confirmation: the patch diff shows the id_dependente value was taken directly from $_POST and interpolated into the query string, and the fix replaces it with filter_input() plus a bound PDO prepared statement - so the flaw is real and unambiguous. However, the signals point to a serious-but-not-emergency priority rather than a mass-exploitation event. The provided CVSS 4.0 vector (9.4) uses PR:H and marks subsequent-system impact (SC/SI/SA:H) as High, but the patched code only gates the endpoint behind a logged-in session ($_SESSION['usuario']) and a permissao.php check - that implies an authenticated low-privilege user, not a high-privilege operator, and there is no evidence of a scope change affecting a separate system, so the vendor vector likely overstates both PR and subsequent impact. Publicly available exploit code exists (Exploit-DB 52483) which raises practical risk, but the CVE is NOT in CISA KEV and EPSS is only 0.89% (58th percentile), indicating no observed widespread exploitation. Net: confirmed, easily exploitable post-authentication database compromise, but constrained by the authentication requirement and the niche footprint of the product, so this is a prompt-patch item rather than a drop-everything emergency.

An authenticated WeGIA user (or an attacker who has obtained any valid session) submits a crafted id_dependente value in a POST request to /html/funcionario/dependente_documento.php, injecting arbitrary SQL that the application concatenates directly into its query. Public exploit code is available (Exploit-DB 52483), making reliable extraction, modification, or destruction of database contents straightforward. Because CVSS is AV:N/AC:L, this requires only network access and a single well-formed request with no special timing or race conditions.