CVE-2025-24902
Published: 03 February 2025
Summary
CVE-2025-24902 is a critical-severity SQL Injection (CWE-89) vulnerability in Wegia Wegia. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 36.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-24902 is a SQL injection vulnerability (CWE-89) affecting the WeGIA application, an open-source web manager for charitable institutions. The issue resides in the `salvar_cargo.php` endpoint, where insufficient input validation allows arbitrary SQL query execution. It impacts versions of WeGIA prior to 3.2.12 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts.
An authorized attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and without requiring user interaction (UI:N). Exploitation enables execution of arbitrary SQL queries, potentially allowing the attacker to access or delete sensitive information stored in the application's database.
The vulnerability has been fixed in WeGIA version 3.2.12, and all users are advised to upgrade promptly, as no workarounds are available. Additional details are provided in the GitHub security advisory at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-pg73-w9vx-8mgp and the patching commit at https://github.com/LabRedesCefetRJ/WeGIA/commit/f535e873a8f26fe413d21f22e3eacc8c79b2fa7f.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3983
Vulnerability details
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_cargo.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information.…
more
This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SQL injection vulnerability in the publicly accessible WeGIA web application directly enables remote exploitation of a public-facing application to execute arbitrary queries and impact the database.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validating inputs to the salvar_cargo.php endpoint to block arbitrary SQL query execution.
Mandates timely flaw remediation by upgrading to WeGIA 3.2.12, eliminating the SQL injection vulnerability.
Vulnerability scanning identifies SQL injection flaws like this one in salvar_cargo.php for subsequent remediation.