CVE-2025-23219: WeGIA has a SQL Injection endpoint 'adicionar_cor.php' parameter 'cor'
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the WeGIA application, specifically in the adicionarcor.php endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in the database, allowing unauthorized access to sensitive information. During the exploit, it was possible to perform a complete dump of the application's database, highlighting the severity of the flaw. This vulnerability is fixed in 3.2.10.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23219?
CVE-2025-23219 is classified as a critical vulnerability due to its potential to allow arbitrary SQL execution.
How do I fix CVE-2025-23219?
To fix CVE-2025-23219, update the WeGIA application to version 3.2.10 or later, which addresses the SQL injection issue.
What are the potential impacts of exploiting CVE-2025-23219?
Exploiting CVE-2025-23219 can lead to unauthorized access to the database, data manipulation, and potentially complete control over the application.
Which version of WeGIA is affected by CVE-2025-23219?
CVE-2025-23219 affects WeGIA versions prior to 3.2.10.
Is there a workaround for CVE-2025-23219?
There are no known workarounds for CVE-2025-23219; the recommended action is to update the software.