WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, an OS Command Injection vulnerability was identified in the /html/configuracao/debug_info.php endpoint. The branch parameter is not properly sanitized before being concatenated and executed in a shell command on the server's operating system. This flaw allows an unauthenticated attacker to execute arbitrary commands on the server with the privileges of the web server user (www-data). This issue has been patched in version 3.4.2.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/LabRedesCefetRJ/WeGIA/commit/45f32ad1d52775fc99f3c90075c8136c6d4d1d3d | Patch |
| https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-52p5-5fmw-9hrf | Exploit Vendor Advisory |
Configurations
History
02 Jul 2025, 16:21
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Wegia
Wegia wegia |
|
| CPE | cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:* | |
| References | () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-52p5-5fmw-9hrf - Exploit, Vendor Advisory | |
| References | () https://github.com/LabRedesCefetRJ/WeGIA/commit/45f32ad1d52775fc99f3c90075c8136c6d4d1d3d - Patch |
19 Jun 2025, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-06-19 04:15
Updated : 2025-07-02 16:21
NVD link : CVE-2025-50201
Mitre link : CVE-2025-50201
JSON object : View
Products Affected
wegia
- wegia
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')