CVE-2025-27133
Published: 24 February 2025
Summary
CVE-2025-27133 is a critical-severity SQL Injection (CWE-89) vulnerability in Wegia Wegia. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-27133 is a SQL injection vulnerability (CWE-89) in the WeGIA web application prior to version 3.2.15. WeGIA serves as a web manager for charitable institutions. The issue is located in the `adicionar_tipo_exame.php` endpoint and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An authorized attacker with low privileges can exploit this vulnerability remotely over the network with low attack complexity and without requiring user interaction. Exploitation enables execution of arbitrary SQL queries, granting access to sensitive information and potentially causing high impacts to confidentiality, integrity, and availability.
The WeGIA project patched this vulnerability in version 3.2.15. Mitigation involves upgrading to this version or later. Details are provided in the GitHub security advisory at GHSA-xj79-w799-qjcp and the fixing commit at 619ead748e18e685459c6dc3c226e621b9ff5403.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5078
Vulnerability details
WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was discovered in the WeGIA application prior to version 3.2.15 at the `adicionar_tipo_exame.php` endpoint. This vulnerability allows an authorized attacker to execute arbitrary SQL queries, allowing access to…
more
sensitive information. Version 3.2.15 contains a patch for the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in a web application directly enables remote exploitation of public-facing applications (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 mandates validation of user inputs to the adicionar_tipo_exame.php endpoint, directly preventing SQL injection attacks by rejecting or sanitizing malicious SQL queries.
SI-2 requires timely remediation of application flaws, including applying the patch for CVE-2025-27133 released in WeGIA version 3.2.15.
RA-5 ensures regular vulnerability scanning of web applications like WeGIA to detect and remediate SQL injection vulnerabilities prior to exploitation.