Critical · published October 3, 2025
🚨 A crafty SQL injection is lurking in WeGIA versions 3.4.12 and below! This vulnerability in the /pet/profile_pet.php endpoint lets attackers execute arbitrary SQL commands like a magician pulling rabbits out of hats! 🔥 Think of this vulnerability as a restaurant where someone could sneak in and change the orders directly in the kitchen without anyone noticing. With just a little bit of clever persuasion, they could change every meal being served! If exploited, an attacker could completely compromise your database—altering, deleting, or even stealing sensitive information like donor details or pet profiles. This could be absolutely devastating for any charitable institution relying on the integrity of its data!
Think of this vulnerability as a restaurant where someone could sneak in and change the orders directly in the kitchen without anyone noticing. With just a little bit of clever persuasion, they could change every meal being served! The SQL injection vulnerability in WeGIA allows attackers to manipulate the id_pet parameter in the /pet/profile_pet.php endpoint. This means they can run arbitrary SQL commands against the database, jeopardizing its confidentiality, integrity, and availability.
If exploited, an attacker could completely compromise your database—altering, deleting, or even stealing sensitive information like donor details or pet profiles. This could be absolutely devastating for any charitable institution relying on the integrity of its data! Immediate action is required: update WeGIA to version 3.5.0 or later to patch this vulnerability. Additionally, consider implementing prepared statements to safeguard against future injection attacks. It's always a good idea to audit your inputs! You've got this! Follow these steps to secure your system, and you'll be a true security hero! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| wegia/wegia | < 3.5.0 | 3.5.0 |