CVE-2025-24905
Published: 03 February 2025
Summary
CVE-2025-24905 is a critical-severity SQL Injection (CWE-89) vulnerability in Wegia Wegia. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-24905 is a SQL injection vulnerability in the WeGIA application, a web manager for charitable institutions. The flaw resides in the `get_codigobarras_cobranca.php` endpoint, where insufficient input validation allows arbitrary SQL query execution. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-89. The vulnerability affects WeGIA versions prior to 3.2.12.
An authorized attacker can exploit this vulnerability remotely with low complexity, requiring no privileges, user interaction, or special conditions. Successful exploitation enables execution of arbitrary SQL queries, potentially granting access to or deletion of sensitive information in the database.
The issue has been addressed in WeGIA version 3.2.12, and all users are advised to upgrade immediately. No workarounds are known. Additional details are available in the GitHub Security Advisory at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qjc6-5qv6-fr8m.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3986
Vulnerability details
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_codigobarras_cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information.…
more
This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SQL injection vulnerability in the publicly accessible WeGIA web application endpoint directly enables remote exploitation of a public-facing application without authentication, matching T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the SQL injection vulnerability by requiring validation of inputs to the get_codigobarras_cobranca.php endpoint to ensure they are within expected format and range.
Mandates timely flaw remediation, including upgrading to WeGIA version 3.2.12 where this specific SQL injection issue is fixed.
Enforces restrictions on information inputs at system boundaries to block invalid or malicious SQL payloads targeting the vulnerable endpoint.