CVE-2025-24901
Published: 03 February 2025
Summary
CVE-2025-24901 is a critical-severity SQL Injection (CWE-89) vulnerability in Wegia Wegia. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-24901 is a SQL injection vulnerability (CWE-89) affecting the WeGIA web application, a Web Manager for Charitable Institutions. The issue is located in the `deletar_permissao.php` endpoint and allows execution of arbitrary SQL queries. It impacts versions of WeGIA prior to 3.2.12 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An authorized attacker with low privileges can exploit this vulnerability remotely over the network with low attack complexity and without requiring user interaction. Successful exploitation enables the execution of arbitrary SQL queries, potentially granting access to sensitive information or allowing its deletion, with high impacts on confidentiality, integrity, and availability.
The GitHub Security Advisory (GHSA-jp48-94wm-3gmc) confirms the issue has been fixed in WeGIA version 3.2.12, urging all users to upgrade immediately. No workarounds are available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3982
Vulnerability details
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_permissao.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information.…
more
This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a public-facing web app endpoint directly enables T1190 by allowing remote arbitrary SQL execution with low-priv access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates SQL injection by requiring validation of user inputs to the deletar_permissao.php endpoint against expected formats and content.
Ensures timely remediation through patching or upgrading WeGIA to version 3.2.12, where the SQL injection flaw is fixed.
Restricts input length, type, and format to the vulnerable endpoint, blocking common SQL injection payloads.