CVE-2025-22141: WeGIA SQL Injection (Blind Time-Based) endpoint 'verificar_recursos_cargo.php' parameter 'cargo'
WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the /dao/verificarrecursoscargo.php endpoint, specifically in the cargo parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.2.8.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22141?
CVE-2025-22141 has a high severity due to the possibility of SQL injection, which can lead to data compromise.
How do I fix CVE-2025-22141?
To fix CVE-2025-22141, ensure proper parameterized queries or prepared statements are used to sanitize user inputs.
Which versions of WeGIA are affected by CVE-2025-22141?
CVE-2025-22141 affects WeGIA versions up to and including 3.2.8.
What type of attack can be performed using CVE-2025-22141?
An attacker can perform unauthorized SQL commands on the /dao/verificar_recursos_cargo.php endpoint due to this vulnerability.
What should I do if I am using an affected version of WeGIA?
If you are using an affected version of WeGIA, it is recommended to update to a patched version and review your database security practices.