CVE-2025-26608
Published: 18 February 2025
Summary
CVE-2025-26608 is a critical-severity SQL Injection (CWE-89) vulnerability in Wegia Wegia. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 35.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection vulnerabilities by enforcing validation of user inputs to the dependente_docdependente.php endpoint before incorporation into SQL queries.
Ensures timely identification, reporting, and patching of flaws like this SQL injection, as addressed in WeGIA version 3.2.13.
Enables proactive detection of SQL injection vulnerabilities through regular vulnerability scanning of web applications like WeGIA.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in unauthenticated public-facing web app endpoint directly enables remote exploitation of public-facing applications without credentials or user interaction.
NVD Description
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `dependente_docdependente.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing…
more
unauthorized access to sensitive information. This issue has been addressed in version 3.2.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Deeper analysisAI
CVE-2025-26608 is a SQL injection vulnerability in the WeGIA open-source web manager application, which targets institutions and primarily serves Portuguese-language users. The flaw resides in the `dependente_docdependente.php` endpoint, where insufficient input validation allows attackers to inject and execute arbitrary SQL queries. Affected by CWE-89 (SQL Injection) and CWE-284 (Improper Access Control), it carries a CVSS v3.1 base score of 9.8, reflecting critical severity due to high impacts on confidentiality, integrity, and availability.
The vulnerability enables remote exploitation over the network with low complexity and no authentication or user interaction required. Any unauthenticated attacker reaching the affected endpoint can craft malicious payloads to execute arbitrary SQL commands, potentially extracting, modifying, or deleting sensitive data such as user records or institutional information stored in the backend database.
The GitHub Security Advisory (GHSA-65h2-7484-2pww) confirms the issue is fixed in WeGIA version 3.2.13, urging all users to upgrade immediately. No workarounds are available, emphasizing the need for prompt patching to prevent exploitation.
Details
- CWE(s)