PT-2025-26206 · Wegia · Wegia

Pedro-Lyrio · Published 2025-06-18 · Updated 2025-06-19 · CVE-2025-50201

Positive Technologies · (AI Summary)

CVSS v3.1

10

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.4.2

Description The issue is related to an OS Command Injection flaw in the "/html/configuracao/debug info.php" endpoint. The branch parameter is not properly sanitized before being concatenated and executed in a shell command on the server's operating system. This allows an unauthenticated attacker to execute arbitrary commands on the server with the privileges of the web server user.

Recommendations For versions prior to 3.4.2, update to version 3.4.2 to resolve the issue. As a temporary workaround, consider restricting access to the "/html/configuracao/debug info.php" endpoint to minimize the risk of exploitation. Avoid using the branch parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-09324

CVE-2025-50201

GHSA-52P5-5FMW-9HRF

Affected Products

Wegia

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/50xxx/CVE-2025-50201.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/commit/45f32ad1d52775fc99f3c90075c8136c6d4d1d3d · Patch
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-52p5-5fmw-9hrf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-50201 · Security Note
• https://bdu.fstec.ru/vul/2025-09324 · Security Note
• https://osv.dev/vulnerability/CVE-2025-50201 · Vendor Advisory
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.4.2 · Note
• https://twitter.com/CVEnew/status/1935723263617007968 · Twitter Post
• https://t.me/latest_high_impact_cve/2717 · Telegram Post
• https://t.me/cvetracker/26553 · Telegram Post
• https://t.me/cvenotify/126152 · Telegram Post
• https://t.me/purp_sec/785 · Telegram Post