Cyber Posture

CVE-2025-27133

HighPublic PoC

Published: 24 February 2025

Published
24 February 2025
Modified
28 February 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0039 60.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-27133 is a SQL injection vulnerability (CWE-89) in the WeGIA web application prior to version 3.2.15. WeGIA serves as a web manager for charitable institutions. The issue is located in the `adicionar_tipo_exame.php` endpoint and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

An authorized attacker with low privileges can exploit this vulnerability remotely over the network with low attack complexity and without requiring user interaction. Exploitation enables execution of arbitrary SQL queries, granting access to sensitive information and potentially causing high impacts to confidentiality, integrity, and availability.

The WeGIA project patched this vulnerability in version 3.2.15. Mitigation involves upgrading to this version or later. Details are provided in the GitHub security advisory at GHSA-xj79-w799-qjcp and the fixing commit at 619ead748e18e685459c6dc3c226e621b9ff5403.

Details

CWE(s)
CWE-89

Affected Products

wegia
wegia
≤ 3.2.15

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

SQL injection vulnerability in a web application directly enables remote exploitation of public-facing applications (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References