CVE-2025-59939: WeGIA vulnerable to SQL Injection into method `excluir` of the `ProdutoControle` class in the parameter `id_produto`.
WeGIA is a Web manager for charitable institutions. Prior to version 3.5.0, WeGIA is vulnerable to SQL Injection attacks in the control.php endpoint with the following parameters: nomeClasse=ProdutoControle&metodo=excluir&idproduto=[malicious command]. It is necessary to apply prepared statements methods, sanitization, and validations on theidproduto parameter. This issue has been patched in version 3.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.5.0 - Configuration
Apply prepared statements, sanitization, and validations to the id_produto parameter in the ProdutoControle excluir method.
WeGIA id_produto input handling = prepared statements, sanitization, and validations
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59939?
CVE-2025-59939 has a high severity rating due to the potential for SQL Injection vulnerabilities.
How do I fix CVE-2025-59939?
To fix CVE-2025-59939, update WeGIA to version 3.5.0 or later to eliminate the SQL Injection vulnerability.
What systems are affected by CVE-2025-59939?
CVE-2025-59939 affects versions of WeGIA prior to version 3.5.0.
What type of attack does CVE-2025-59939 enable?
CVE-2025-59939 allows attackers to perform SQL Injection attacks through specific parameters in the control.php endpoint.
Is it safe to continue using WeGIA if I haven't patched CVE-2025-59939?
Continuing to use WeGIA without patching CVE-2025-59939 poses significant security risks due to potential SQL Injection exploits.