WeGIA is a web manager for charitable institutions. An unauthenticated SQL Injection vulnerability was identified in versions up to and including 3.3.0 in the endpoint `/html/socio/sistema/get_socios.php`, specifically in the query parameter. This issue allows attackers to inject and execute arbitrary SQL statements against the application's underlying database. As a result, it may lead to data exfiltration, authentication bypass, or complete database compromise. Version 3.3.1 fixes the issue.
References
| Link | Resource |
|---|---|
| https://github.com/LabRedesCefetRJ/WeGIA/commit/214dab59509bd3637f94adf381298c12da4ff80f | Patch |
| https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-5qw5-q55h-6qg7 | Exploit Vendor Advisory |
Configurations
History
02 Jul 2025, 16:30
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:* | |
| References | () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-5qw5-q55h-6qg7 - Exploit, Vendor Advisory | |
| References | () https://github.com/LabRedesCefetRJ/WeGIA/commit/214dab59509bd3637f94adf381298c12da4ff80f - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Wegia
Wegia wegia |
07 May 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-07 18:15
Updated : 2025-07-02 16:30
NVD link : CVE-2025-46828
Mitre link : CVE-2025-46828
JSON object : View
Products Affected
wegia
- wegia
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')