by Kastro
Paper/Archive/CVE-2025-24902

CVE-2025-24902

LabRedesCefetRJ WeGIA — SQL Injection endpoint 'salvar_cargo.php' parameter 'id_cargo' in WeGIA

EPSS 0.6%public exploitCVSS 9.4
critical.is priorityof 100
48
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 47.9.479 × 209.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_cargo.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected

ProductAffectedFixed inSource
WeGIA< 3.2.12–CNA

Scores by source

GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-pg73-w9vx-8mgprefgithub.com/LabRedesCefetRJ/WeGIA/commit/f535e873a8f26fe413d21f22e3eacc8c79b2fa7f