by Kastro
Paper/Archive/CVE-2025-22133

CVE-2025-22133

nilsonLazarin WeGIA — WeGIA Allows Arbitrary File Upload with Remote Code Execution (RCE)

EPSS 0.8%public exploitCVSS 10.0
critical.is priorityof 100
51
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 55.2.552 × 2011.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

WeGIA is a web manager for charitable institutions. Prior to 3.2.8, a critical vulnerability was identified in the /WeGIA/html/socio/sistema/controller/controla_xlsx.php endpoint. The endpoint accepts file uploads without proper validation, allowing the upload of malicious files, such as .phar, which can then be executed by the server. This vulnerability is fixed in 3.2.8.

Affected

ProductAffectedFixed inSource
WeGIA< 3.2.8–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/nilsonLazarin/WeGIA/security/advisories/GHSA-mjgr-2jxv-v8qfrefgithub.com/nilsonLazarin/WeGIA/commit/a08f04de96d3caec85496d7a89a5b82d1960d9dd