CVE-2025-53091: WeGIA has Unauthenticated Time-Based Blind SQL Injection in almox Parameter
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the /controle/getProdutosPorAlmox.php endpoint. This issue allows any unauthenticated attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration. Version 3.4.0 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53091?
CVE-2025-53091 is classified as a medium severity vulnerability due to its potential for exploitation via SQL injection.
How do I fix CVE-2025-53091?
To mitigate CVE-2025-53091, validate and sanitize user inputs in the almox parameter before processing.
What version of WeGIA is affected by CVE-2025-53091?
WeGIA version 3.3.3 is affected by CVE-2025-53091 and should be updated to the latest version if available.
What impact does CVE-2025-53091 have on system security?
CVE-2025-53091 allows attackers to execute arbitrary SQL queries, potentially leading to data leakage or manipulation.
Is CVE-2025-53091 only a concern for Portuguese language institutions?
While CVE-2025-53091 was discovered in a software aimed at Portuguese institutions, it affects any instance of WeGIA version 3.3.3.