by Kastro
Paper/Archive/CVE-2025-22141

CVE-2025-22141

nilsonLazarin WeGIA — WeGIA SQL Injection (Blind Time-Based) endpoint 'verificar_recursos_cargo.php' parameter 'cargo'

EPSS 0.7%public exploitCVSS 9.4
critical.is priorityof 100
49
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 53.0.530 × 2010.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the /dao/verificar_recursos_cargo.php endpoint, specifically in the cargo parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.2.8.

Affected

ProductAffectedFixed inSource
WeGIA< 3.2.8–CNA

Scores by source

GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/nilsonLazarin/WeGIA/security/advisories/GHSA-w7hp-2w2c-p636exploitgithub.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-w7hp-2w2c-p636