CVE-2025-26607
Published: 18 February 2025
Summary
CVE-2025-26607 is a critical-severity SQL Injection (CWE-89) vulnerability in Wegia Wegia. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 34.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-26607 is a SQL injection vulnerability (CWE-89, CWE-284) in the open-source WeGIA web manager for institutions, which primarily serves Portuguese-language users. The flaw exists in the `documento_excluir.php` endpoint of the WeGIA application, where insufficient input validation allows attackers to execute arbitrary SQL queries, potentially leading to unauthorized access to sensitive information.
With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability is highly exploitable remotely over the network by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation grants high-impact access to confidential data, enables data modification or deletion, and can disrupt availability, risking full database compromise.
The vulnerability has been addressed in WeGIA version 3.2.13, and all users are advised to upgrade promptly, as no workarounds exist. Additional details are available in the GitHub security advisory at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g6wj-3vm2-c59m.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5093
Vulnerability details
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `documento_excluir.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing…
more
unauthorized access to sensitive information. This issue has been addressed in version 3.2.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app endpoint enables remote unauthenticated exploitation of the application for initial access and data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates SQL injection by requiring validation of user inputs to the documento_excluir.php endpoint before processing SQL queries.
Ensures timely remediation through patching, such as upgrading WeGIA to version 3.2.13 which fixes this specific SQL injection vulnerability.
Restricts the types and quantity of inputs at system boundaries to limit opportunities for injecting malicious SQL payloads.