CVE-2025-26610
Published: 18 February 2025
Summary
CVE-2025-26610 is a critical-severity SQL Injection (CWE-89) vulnerability in Wegia Wegia. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-26610 is a SQL injection vulnerability (CWE-89) affecting WeGIA, an open source Web Manager for Institutions primarily focused on Portuguese language users. The issue resides in the `restaurar_produto_desocultar.php` endpoint, where an authorized attacker can execute arbitrary SQL queries to access sensitive information. Published on 2025-02-18, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with high impacts on confidentiality, integrity, and availability.
The vulnerability can be exploited remotely over the network with low attack complexity, requiring no privileges (PR:N), no user interaction, and no special scoping changes. Despite the description noting an "authorized attacker," the CVSS vector suggests unauthenticated access is feasible, allowing arbitrary SQL execution that could lead to data exfiltration, modification, or denial of service on the underlying database.
The vulnerability has been addressed in WeGIA version 3.2.13, and all users are strongly advised to upgrade. No workarounds are available. For full details, refer to the GitHub Security Advisory at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6p7c-9hcx-jpqj.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5106
Vulnerability details
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `restaurar_produto_desocultar.php` endpoint. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing…
more
access to sensitive information. This issue has been addressed in version 3.2.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vuln in public-facing web app directly enables T1190 (Exploit Public-Facing Application); arbitrary SQL queries facilitate T1213.006 (Databases) for sensitive data access, T1565.001 (Stored Data Manipulation) for modifications, and T1485 (Data Destruction) for DoS via DB operations.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation of untrusted inputs to the restaurar_produto_desocultar.php endpoint, preventing SQL injection payloads from altering database queries.
Mandates timely identification, reporting, and patching of the SQL injection flaw fixed in WeGIA version 3.2.13.
Requires vulnerability scanning that would identify the SQL injection vulnerability in the WeGIA application prior to exploitation.