CVE-2025-24958
Published: 03 February 2025
Summary
CVE-2025-24958 is a critical-severity SQL Injection (CWE-89) vulnerability in Wegia Wegia. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-24958 is a SQL injection vulnerability in the WeGIA application, a web manager for charitable institutions. The flaw resides in the `salvar_tag.php` endpoint, where insufficient input validation allows arbitrary SQL query execution. It affects WeGIA versions prior to 3.2.12 and is classified under CWE-89 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.
An authorized attacker with low-privilege access (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low complexity and no user interaction required. Successful exploitation enables execution of arbitrary SQL queries, potentially granting access to or deletion of sensitive information stored in the database.
The GitHub Security Advisory (GHSA-2mhx-5998-46hx) confirms the issue has been fixed in WeGIA version 3.2.12, urging all users to upgrade immediately. No workarounds are available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3990
Vulnerability details
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_tag.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information.…
more
This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SQL injection vulnerability in the WeGIA web application (salvar_tag.php endpoint) directly enables remote exploitation of a public-facing application to execute arbitrary SQL queries, matching T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates SQL injection by requiring validation and error handling of inputs to the salvar_tag.php endpoint before database query construction.
Requires timely patching of the WeGIA application to version 3.2.12, eliminating the SQL injection vulnerability.
Vulnerability scanning identifies SQL injection flaws like CVE-2025-24958 in web endpoints such as salvar_tag.php.