CVE-2025-26608
Published: 18 February 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-26608 is a SQL injection vulnerability in the WeGIA open-source web manager application, which targets institutions and primarily serves Portuguese-language users. The flaw resides in the `dependente_docdependente.php` endpoint, where insufficient input validation allows attackers to inject and execute arbitrary SQL queries. Affected by CWE-89 (SQL Injection) and CWE-284 (Improper Access Control), it carries a CVSS v3.1 base score of 9.8, reflecting critical severity due to high impacts on confidentiality, integrity, and availability.
The vulnerability enables remote exploitation over the network with low complexity and no authentication or user interaction required. Any unauthenticated attacker reaching the affected endpoint can craft malicious payloads to execute arbitrary SQL commands, potentially extracting, modifying, or deleting sensitive data such as user records or institutional information stored in the backend database.
The GitHub Security Advisory (GHSA-65h2-7484-2pww) confirms the issue is fixed in WeGIA version 3.2.13, urging all users to upgrade immediately. No workarounds are available, emphasizing the need for prompt patching to prevent exploitation.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection in unauthenticated public-facing web app endpoint directly enables remote exploitation of public-facing applications without credentials or user interaction.