PT-2025-26207 · Wegia · Wegia

Nmmorette · Published 2025-06-18 · Updated 2025-06-19 · CVE-2025-52474

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.4.2

Description A SQL Injection issue was identified in the id parameter of the "/WeGIA/controle/control.php" endpoint, allowing attackers to manipulate SQL queries and access sensitive database information, such as table names and sensitive data.

Recommendations For versions prior to 3.4.2, update to version 3.4.2 to resolve the issue. As a temporary workaround, consider restricting access to the "/WeGIA/controle/control.php" endpoint to minimize the risk of exploitation. Avoid using the id parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-09323

CVE-2025-52474

GHSA-RWVH-2GFH-WMCM

Affected Products

Wegia

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52474.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-rwvh-2gfh-wmcm · Vendor Advisory
• https://github.com/LabRedesCefetRJ/WeGIA/commit/b6fbb3e21b8d71e50afe0395dca44acdd1ca2e29 · Patch
• https://osv.dev/vulnerability/CVE-2025-52474 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09323 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-52474 · Security Note
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.4.2 · Note
• https://twitter.com/VulmonFeeds/status/1935573088130732431 · Twitter Post
• https://t.me/cvenotify/126153 · Telegram Post
• https://t.me/cvetracker/26554 · Telegram Post
• https://twitter.com/CVEnew/status/1935723260853006495 · Twitter Post
• https://t.me/latest_high_impact_cve/2717 · Telegram Post