EUVD-2025-18678
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Description
WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, a SQL Injection vulnerability was identified in the id parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data. This issue has been patched in version 3.4.2.
Analysis
Critical SQL Injection vulnerability in WeGIA (a web-based management system for charitable institutions) affecting the 'id' parameter of the /WeGIA/controle/control.php endpoint in versions prior to 3.4.2. This unauthenticated, network-accessible vulnerability enables attackers to execute arbitrary SQL queries without privileges or user interaction, resulting in complete compromise of database confidentiality, integrity, and availability. The CVSS 9.8 score reflects the severe impact potential; however, KEV status, EPSS probability, and public POC availability could not be confirmed from provided data and should be verified through CISA and exploit databases.
Technical Context
WeGIA is a PHP-based web application framework for non-profit/charitable institution management. The vulnerability exists in the control.php endpoint's insufficient input validation on the 'id' parameter, allowing unsanitized user input to be concatenated into SQL query strings. This is a classic SQL Injection flaw (CWE-89: Improper Neutralization of Special Elements used in an SQL Command), where an attacker can inject SQL metacharacters (e.g., single quotes, UNION statements, comments) to alter query logic. The root cause is the absence of parameterized queries or prepared statements, combined with lack of input sanitization. Affected systems typically run PHP with MySQL/MariaDB backends. The /controle/control.php endpoint likely handles data retrieval/manipulation for administrative functions, making it a high-value attack surface.
Affected Products
Vendor: WeGIA; Product: WeGIA (Charitable Institution Web Manager); Affected Versions: < 3.4.2; Fixed Version: 3.4.2 and later. Likely CPE approximation: cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:* (versions < 3.4.2). Specific configurations impacted: All web-deployed instances of WeGIA prior to patching, particularly those exposed to untrusted networks. No vendor advisory URL was provided in references; operators should contact WeGIA vendor directly or consult their documentation repository.
Remediation
IMMEDIATE: (1) Upgrade WeGIA to version 3.4.2 or later. Verify patch application by checking version strings and deployment artifacts. (2) If immediate patching is not feasible, implement compensating controls: (a) Web Application Firewall (WAF) rules to block SQL injection payloads in the 'id' parameter (e.g., regex rules for UNION, SELECT, comment syntax). (b) Network-level access restrictions: limit access to /WeGIA/controle/control.php to trusted IP ranges or require VPN. (c) Database-level hardening: use database accounts with minimal privileges; implement row-level security. (3) Post-patch: validate remediation by testing the id parameter with known SQL injection payloads (e.g., 'id=1 OR 1=1--'); responses should not reveal database errors or unexpected data. (4) Review WeGIA security advisories at vendor support portal for any additional patches or related issues.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today