CVE-2025-61603: WeGIA: SQL Injection (Blind Time-Based) Vulnerability in API `descricao` Parameter
WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability which was identified in the /controle/control.php endpoint, specifically in the descricao parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue is fixed in version 3.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61603?
CVE-2025-61603 is considered a high-severity vulnerability due to its potential for SQL Injection attacks.
How do I fix CVE-2025-61603?
To fix CVE-2025-61603, upgrade WeGIA to version 3.5.0 or later where this vulnerability is addressed.
Which versions of WeGIA are affected by CVE-2025-61603?
Versions 3.4.12 and below of WeGIA are affected by CVE-2025-61603.
What kind of attack can be conducted using CVE-2025-61603?
CVE-2025-61603 allows attackers to execute arbitrary SQL commands through the descricao parameter.
What component of WeGIA does CVE-2025-61603 impact?
CVE-2025-61603 specifically impacts the /controle/control.php endpoint of WeGIA.