EUVD-2026-101621Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFind pre-install WeGIA installer endpoint
-
DeliverySend unauthenticated installation POST (reinstalar)
-
ExploitInject shell metacharacters via usuario field
-
Executionshell_exec runs command as web user
-
ImpactExecute code and persist via config.php
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable only against WeGIA instances prior to 3.8.6 where ../config.php does not yet exist, because instalador.php redirects installed instances to home.php; the attacker must reach the pre-installation web/instalador/instalador.php endpoint and submit the Linux reinstall flow (reinstalar set) with a crafted usuario POST value containing shell metacharacters, which the host must be running Linux to hit the shell_exec() mysql import branch. Limiting factors: the narrow pre-install/reinstall window, Linux-only command sink, and the need for the mysql client path make this realistic mainly against freshly deployed, abandoned-mid-setup, or deliberately re-installable instances rather than fully configured production systems; no authentication is required in that window (PR:N). |
| Impact | This is a genuine OS command injection (CWE-78) in WeGIA's pre-installation endpoint, but real-world risk is moderate and heavily gated by a deployment-state precondition, which the CVSS:3.1 vector's AC:H correctly reflects. The vector is AV:N/PR:N/UI:N (network-reachable, unauthenticated, no user interaction), yet AC:H because web/instalador/instalador.php only processes installation POST data while config.php does not yet exist - once the application is installed it redirects to home.php and the sink is unreachable. The source diff confirms the flaw: the Linux reinstall branch interpolates the POST-controlled usuario into shell_exec("mysql ... -u $user -p$senha $nomeDB < ..."), so the attack chain is real, not theoretical. A notable signal conflict: the published CVSS sets C:N and A:L, but command execution as the web-server user plus attacker-controlled rewriting of executable config.php realistically implies confidentiality loss and higher availability/integrity impact - the official vector appears to understate impact (see assessed vector). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or automated weaponization. Net: a legitimate, high-integrity-impact flaw whose practical exposure is limited to unconfigured or re-installable instances, making it a patch-soon rather than drop-everything issue for the small population actually running WeGIA. |
| Exploit ScenarioDerived | An attacker locates an internet-reachable WeGIA deployment that has not completed installation (config.php absent), then sends an unauthenticated POST to instalador.php with the reinstalar flag and a usuario value containing shell metacharacters. On a Linux host this value is concatenated into a mysql command run via shell_exec(), executing arbitrary commands as the web-server user; no public exploit code was identified at time of analysis, though the vulnerable sink is visible in the published commit diff. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Unauthenticated OS command injection in WeGIA prior to 3.8.6 lets remote attackers execute arbitrary commands as the web-server user through the pre-installation web/instalador/instalador.php endpoint, which remains reachable whenever ../config.php has not yet been created. The attacker submits the Linux reinstall flow with a crafted 'usuario' POST value containing shell metacharacters that is interpolated into a shell_exec() mysql import command; the same endpoint also writes attacker-controlled values into an executable config.php and concatenates the 'nomebd' database name into a CREATE DATABASE statement. Exploitation is gated by a deployment-state precondition - the installer only processes POST data while config.php is absent, and the command sink is reached only on Linux - which the CVSS:3.1 vector's AC:H reflects; no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and authentication requirements are unauthenticated per the PR:N vector.
RemediationAI
Vendor-released patch: upgrade to WeGIA 3.8.6 (https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6), which incorporates the fix in commit b13c4b0b416d99a8145f583e0893bc8172155469 referenced by advisory GHSA-wm6j-4rfm-399q and PR #1705. Because the exploitability condition is the absence of ../config.php, the single most effective compensating control is to ensure the application is fully installed so that config.php exists and instalador.php redirects incoming requests to home.php; verify this file is present and non-empty after any deployment, and treat a missing config.php as an active exposure. Where the installer must be kept, restrict access at the web-server layer by denying requests to the /instalador/ path from untrusted sources (for Apache, an <Directory> or <Location> Require all denied block; for nginx, a location ^~ /instalador/ { deny all; } rule), with the trade-off that legitimate remote initial setup and web-based reinstallation will stop working and must then be performed locally or after temporarily re-enabling the rule. Deleting or moving the web/instalador/ directory entirely after installation removes the attack surface permanently, with the trade-off that future upgrades requiring the installer must be completed manually. Until patching is feasible, avoid running the reinstall flow on Linux instances and, if you must, never submit untrusted or third-party-supplied values in the install form, since the usuario, senha, nomebd, local and backup fields all flow into either the shell command, the generated config.php, or the CREATE DATABASE statement. Finally, because the pre-patch installer writes attacker-controlled values into executable config.php, any host that was exposed while unpatched should be treated as potentially compromised: review config.php for injected content, rotate database credentials, and confirm no web-server-user shell access was obtained by inspecting process, shell history and file-integrity records.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic OS command injection (CWE-78) in a PHP web installer. WeGIA's web/instalador/instalador.php begins by checking file_exists("../config.php"); if the configuration already exists the request is redirected to ../html/home.php, but on a freshly deployed, abandoned-mid-setup, or deliberately re-installable instance the endpoint processes POST parameters unauthenticated. On the Linux branch, when the 'reinstalar' checkbox is set, the script loops over the SQL files discovered in ../BD/ and builds a string of the form shell_exec("mysql --default-character-set=utf8 -u $user -p$senha $nomeDB < ..."), directly interpolating the attacker-supplied 'usuario', 'senha' and database-name values without escaping - shell metacharacters in 'usuario' therefore break out of the mysql invocation and run arbitrary commands as the web-server user. The same request path compounds the injection: the installer opens ../config.php for writing and emits attacker-controlled 'nomebd', 'usuario', 'senha', 'local', 'backup' and 'www' values into PHP define() statements, persisting attacker-controlled configuration into executable PHP, and it concatenates the unescaped database name into a CREATE DATABASE statement (creating a secondary SQL injection surface). The patch commit b13c4b0b416d99a8145f583e0893bc8172155469 removes the vulnerable pre-installation handling from instalador.php; the associated fix is tracked in issue #96, PR #1705 and advisory GHSA-wm6j-4rfm-399q. Because the endpoint is only useful before config.php exists, realistic exposure is limited to instances in that narrow pre-install window rather than fully configured production deployments, and the impact is constrained to the privileges of the web-server user.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Unauthenticated network injection (PR:N/AV:N) but gated by the pre-install/config-absent state so AC:H; shell_exec as web-server user yields full code execution, hence C:H/I:H/A:H.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(). The installer also writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement. Successful exploitation can execute commands as the web-server user, persist attacker-controlled PHP configuration, and alter or disrupt the application and its data. This issue is fixed in version 3.8.6.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB