PT-2025-5599 · Wegia · Wegia

L8Bl · CVE-2025-24905 · Publicado 2025-02-03 · Atualizado 2025-02-13

Positive Technologies (AI Summary)

CVSS v4.0

10

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.2.12

Description A SQL Injection issue was discovered in the WeGIA application, affecting the get codigobarras cobranca.php endpoint. This could allow an authorized attacker to execute arbitrary SQL queries, enabling access to or deletion of sensitive information.

Recommendations For WeGIA versions prior to 3.2.12, upgrade to version 3.2.12 to resolve the issue. As a temporary workaround, consider restricting access to the get codigobarras cobranca.php endpoint until the upgrade is applied.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-24905

GHSA-QJC6-5QV6-FR8M

Produtos afetados

Wegia

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24905.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qjc6-5qv6-fr8m · Aviso do Fabricante
• https://t.me/cvenotify/109788 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/1886535522043998365 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1886553608222658662 · Publicação no Twitter
• https://t.me/cvenotify/111276 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-24905 · Nota de Segurança
• https://twitter.com/GrimmAnalyst/status/1886559440389783567 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-24905 · Aviso do Fabricante
• https://t.me/cvedetector/17128 · Publicação no Telegram
• https://twitter.com/dailycve/status/1890142619910697249 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1886554139108196435 · Publicação no Twitter