CVE-2025-26617
Published: 18 February 2025
Summary
CVE-2025-26617 is a critical-severity SQL Injection (CWE-89) vulnerability in Wegia Wegia. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 34.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-26617 is a SQL injection vulnerability (CWE-89, CWE-284) affecting WeGIA, an open-source web manager for institutions primarily aimed at Portuguese-language users. The flaw exists in the `historico_paciente.php` endpoint, where insufficient input validation allows attackers to execute arbitrary SQL queries, potentially leading to unauthorized access to sensitive information. Published on 2025-02-18, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical.
The vulnerability is exploitable remotely by unauthenticated attackers (PR:N) over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables arbitrary SQL execution, granting high-impact access to confidential data (C:H), as well as the ability to modify (I:H) or disrupt (A:H) database operations under unchanged scope (S:U), such as extracting patient records or altering institutional data.
The vulnerability has been addressed in WeGIA version 3.2.14, with all users advised to upgrade promptly. No workarounds are known. Additional details are available in the GitHub security advisory at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-f654-c5r5-jx77.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5095
Vulnerability details
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `historico_paciente.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing…
more
unauthorized access to sensitive information. This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SQL injection vulnerability in the public-facing WeGIA web application directly enables T1190 (Exploit Public-Facing Application) for remote unauthenticated initial access and arbitrary database query execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation and sanitization of user inputs to the historico_paciente.php endpoint before incorporation into SQL queries.
Mitigates the specific SQL injection flaw by mandating timely patching to WeGIA version 3.2.14 where the vulnerability is fixed.
Reduces the impact of successful SQL injection by enforcing least privilege on the database account used by the web application, limiting unauthorized data access and modifications.