Critical · published October 3, 2025
🔥 A crafty SQL injection lurks in WeGIA versions 3.4.12 and below, enabling attackers to execute arbitrary SQL commands right through the /controle/control.php endpoint! 🔥 Think of it like a restaurant where anyone can rewrite the menu from their table, ordering anything they want without authorization — an absolute recipe for chaos! 🍽️ If exploited, this vulnerability could allow attackers to compromise the confidentiality, integrity, and availability of your database. They could delete records, alter data, or even expose sensitive information, leaving your charitable institution in a precarious position!
Think of it like a restaurant where anyone can rewrite the menu from their table, ordering anything they want without authorization — an absolute recipe for chaos! 🍽️ This SQL injection vulnerability in WeGIA allows attackers to manipulate the 'descricao' parameter in the control.php file to execute arbitrary SQL commands, bypassing normal security checks and accessing the database directly.
If exploited, this vulnerability could allow attackers to compromise the confidentiality, integrity, and availability of your database. They could delete records, alter data, or even expose sensitive information, leaving your charitable institution in a precarious position! To secure your system, immediately upgrade to WeGIA version 3.5.0 or above. Additionally, review your application for potential SQL injection vulnerabilities and implement prepared statements to safeguard against similar exploits in the future. You've got this! Patch your systems, and you'll be a security hero in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| wegia/wegia | < 3.5.0 | 3.5.0 |