PT-2025-3396 · Wegia · Wegia

Natan Maia Morette · Published 2025-01-17 · Updated 2025-03-18 · CVE-2024-57035

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WeGIA version 3.2.0

Description The issue concerns a SQL Injection vulnerability. It can be exploited through the nextPage parameter in the "/controle/control.php" API endpoint.

Recommendations For WeGIA version 3.2.0, consider disabling the nextPage parameter in the "/controle/control.php" endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the nextPage parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-57035

Affected Products

Wegia

References · 8

• 🔥 https://github.com/nilsonLazarin/WeGIA/issues/827 · Exploit
• 🔥 https://github.com/nmmorette/vulnerability-research/tree/main/CVE-2024-57035 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-57035 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57035 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1880368500050395258 · Twitter Post
• https://t.me/cvedetector/15744 · Telegram Post
• https://t.me/cvenotify/115221 · Telegram Post
• https://twitter.com/CVEnew/status/1880384744841458158 · Twitter Post