CVE-2025-24906
Published: 03 February 2025
Summary
CVE-2025-24906 is a critical-severity SQL Injection (CWE-89) vulnerability in Wegia Wegia. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation of all application inputs, directly preventing SQL injection in the get_detalhes_cobranca.php endpoint by sanitizing user data before SQL query construction.
SI-2 mandates timely flaw remediation, such as upgrading WeGIA to version 3.2.12, which patches this specific SQL injection vulnerability.
RA-5 enables vulnerability scanning to identify SQL injection flaws like CVE-2025-24906 in web endpoints prior to exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app enables remote unauthenticated exploitation for data access/deletion, directly mapping to T1190 Exploit Public-Facing Application.
NVD Description
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information.…
more
This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Deeper analysisAI
CVE-2025-24906 is a SQL injection vulnerability (CWE-89) discovered in the WeGIA application, a web manager for charitable institutions. The flaw affects the `get_detalhes_cobranca.php` endpoint and has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It impacts WeGIA versions prior to 3.2.12.
An authorized attacker can exploit this vulnerability remotely over the network to execute arbitrary SQL queries, enabling access to or deletion of sensitive information. The CVSS metrics indicate low attack complexity, no required privileges or user interaction, and high impacts on confidentiality, integrity, and availability.
The vulnerability has been addressed in WeGIA version 3.2.12, with all users advised to upgrade immediately. No workarounds are known. Additional details are available in the GitHub Security Advisory at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jpph-g9p7-9jrm.
Details
- CWE(s)