CVE-2025-26607
Published: 18 February 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-26607 is a SQL injection vulnerability (CWE-89, CWE-284) in the open-source WeGIA web manager for institutions, which primarily serves Portuguese-language users. The flaw exists in the `documento_excluir.php` endpoint of the WeGIA application, where insufficient input validation allows attackers to execute arbitrary SQL queries, potentially leading to unauthorized access to sensitive information.
With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability is highly exploitable remotely over the network by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidential data, enables data modification or deletion, and can disrupt availability, risking full database compromise.
The vulnerability has been addressed in WeGIA version 3.2.13, and all users are advised to upgrade promptly, as no workarounds exist. Additional details are available in the GitHub security advisory at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g6wj-3vm2-c59m.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection in public-facing web app endpoint enables remote unauthenticated exploitation of the application for initial access and data access.