CVE-2025-22141: WeGIA SQL Injection (Blind Time-Based) endpoint 'verificar_recursos_cargo.php' parameter 'cargo'
First published: Wed Jan 08 2025(Updated: )
WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the /dao/verificar_recursos_cargo.php endpoint, specifically in the cargo parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.2.8.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wegia Wegia | <3.2.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-22141?
CVE-2025-22141 has a high severity due to the possibility of SQL injection, which can lead to data compromise.
How do I fix CVE-2025-22141?
To fix CVE-2025-22141, ensure proper parameterized queries or prepared statements are used to sanitize user inputs.
Which versions of WeGIA are affected by CVE-2025-22141?
CVE-2025-22141 affects WeGIA versions up to and including 3.2.8.
What type of attack can be performed using CVE-2025-22141?
An attacker can perform unauthorized SQL commands on the /dao/verificar_recursos_cargo.php endpoint due to this vulnerability.
What should I do if I am using an affected version of WeGIA?
If you are using an affected version of WeGIA, it is recommended to update to a patched version and review your database security practices.
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/source
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/wegia
- canonical/wegia web manager for charitable institutions