PT-2025-28219 · Wegia · Wegia

Pedro-Lyrio · Published 2025-07-07 · Updated 2025-07-07 · CVE-2025-53529

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.3

Description: A critical issue was identified in WeGIA, a web manager for charitable institutions. The /html/funcionario/profile funcionario.php endpoint is vulnerable due to the id funcionario parameter not being properly sanitized or validated before being used in a SQL query. This allows an unauthenticated attacker to inject arbitrary SQL commands.

Recommendations: For versions prior to 3.4.3, update to version 3.4.3 to resolve the issue. As a temporary workaround, consider restricting access to the /html/funcionario/profile funcionario.php endpoint until the update is applied. Additionally, avoid using the id funcionario parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-53529

GHSA-RRJ6-PJ6W-8J2R

Affected Products

Wegia

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53529.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-rrj6-pj6w-8j2r · Vendor Advisory
• https://github.com/LabRedesCefetRJ/WeGIA/commit/0a061bcc5024937edd18ab3e65ccc8f38deb6957 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-53529 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53529 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1942269851684229429 · Twitter Post
• https://twitter.com/cybercronai/status/1942283178049196365 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1942296827962720664 · Twitter Post
• https://twitter.com/CVEnew/status/1942271222932463934 · Twitter Post