CVE-2025-26609
Published: 18 February 2025
Summary
CVE-2025-26609 is a critical-severity SQL Injection (CWE-89) vulnerability in Wegia Wegia. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 35.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by requiring validation of untrusted inputs to the familiar_docfamiliar.php endpoint before processing SQL queries.
Mandates timely flaw remediation, such as upgrading WeGIA to version 3.2.14, to eliminate the specific SQL injection vulnerability.
Enforces boundary protection with web application firewalls or similar to inspect and block malicious SQL injection payloads targeting the vulnerable endpoint.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app enables remote unauthenticated exploitation for initial access and database compromise.
NVD Description
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `familiar_docfamiliar.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing…
more
unauthorized access to sensitive information. This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Deeper analysisAI
CVE-2025-26609 is a SQL injection vulnerability in the WeGIA open-source web manager application, primarily targeted at Portuguese-language institutional users. The flaw resides in the `familiar_docfamiliar.php` endpoint, enabling attackers to execute arbitrary SQL queries and gain unauthorized access to sensitive information. Associated with CWE-89 (SQL Injection) and CWE-284 (Improper Access Control), it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.
The vulnerability is exploitable remotely over the network by unauthenticated attackers with no privileges or user interaction required, making it highly accessible. Successful exploitation allows arbitrary SQL query execution, potentially leading to full database compromise, including data exfiltration, modification, or deletion of sensitive institutional records.
The GitHub security advisory (GHSA-h7jx-ggv8-v2rh) confirms the issue is fixed in WeGIA version 3.2.14, urging all users to upgrade immediately, with no known workarounds available.
Details
- CWE(s)