CVE-2025-27133
Published: 24 February 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-27133 is a SQL injection vulnerability (CWE-89) in the WeGIA web application prior to version 3.2.15. WeGIA serves as a web manager for charitable institutions. The issue is located in the `adicionar_tipo_exame.php` endpoint and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An authorized attacker with low privileges can exploit this vulnerability remotely over the network with low attack complexity and without requiring user interaction. Exploitation enables execution of arbitrary SQL queries, granting access to sensitive information and potentially causing high impacts to confidentiality, integrity, and availability.
The WeGIA project patched this vulnerability in version 3.2.15. Mitigation involves upgrading to this version or later. Details are provided in the GitHub security advisory at GHSA-xj79-w799-qjcp and the fixing commit at 619ead748e18e685459c6dc3c226e621b9ff5403.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection vulnerability in a web application directly enables remote exploitation of public-facing applications (T1190).