CVE-2025-30364
Published: 27 March 2025
Summary
CVE-2025-30364 is a critical-severity SQL Injection (CWE-89) vulnerability in Wegia Wegia. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 43.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents SQL injection by requiring validation and sanitization of user inputs such as the id_funcionario parameter to block arbitrary SQL command execution.
SI-2 addresses the vulnerability through flaw remediation by mandating timely patching to WeGIA version 3.2.8, which fixes the input validation flaw.
SI-9 mitigates SQL injection by restricting information inputs to safe formats, types, and sources for parameters like id_funcionario, preventing malicious payloads.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in unauthenticated public-facing web endpoint directly enables T1190 (Exploit Public-Facing Application); arbitrary SQL execution facilitates T1213.006 (Data from Information Repositories: Databases) for extraction/modification/deletion.
NVD Description
WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.8 in the endpoint /WeGIA/html/funcionario/remuneracao.php, in the id_funcionario parameter. This vulnerability allows the execution of arbitrary SQL commands, which can compromise the…
more
confidentiality, integrity, and availability of stored data. Version 3.2.8 fixes the issue.
Deeper analysisAI
CVE-2025-30364 is a SQL injection vulnerability (CWE-89) affecting WeGIA, a web-based management system for charitable institutions, in versions prior to 3.2.8. The flaw resides in the endpoint /WeGIA/html/funcionario/remuneracao.php, specifically within the id_funcionario parameter, which fails to properly sanitize user input. This allows attackers to inject and execute arbitrary SQL commands against the underlying database. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.
Remote attackers require no authentication, privileges, or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation enables arbitrary SQL command execution, potentially allowing full database compromise, including data extraction, modification, deletion, or denial of service through destructive queries.
The GitHub security advisory (GHSA-x3ff-5qp7-43qv) confirms that upgrading to WeGIA version 3.2.8 resolves the issue by addressing the input validation flaw in the affected endpoint. Security practitioners should prioritize patching affected instances and review access logs for suspicious activity targeting the remuneracao.php endpoint.
Details
- CWE(s)