CVE-2025-61605: WeGIA: SQL Injection (Blind Time-Based) Vulnerability in /pet/profile_pet.php Endpoint
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerability which was identified in the /pet/profilepet.php endpoint, specifically in the idpet parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue is fixed in version 3.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61605?
CVE-2025-61605 is classified as a high severity SQL Injection vulnerability affecting WeGIA versions 3.4.12 and below.
How do I fix CVE-2025-61605?
To fix CVE-2025-61605, update WeGIA to version 3.5.0 or greater.
What systems are affected by CVE-2025-61605?
CVE-2025-61605 affects WeGIA versions 3.4.12 and earlier, specifically impacting the /pet/profile_pet.php endpoint.
What type of vulnerability is CVE-2025-61605?
CVE-2025-61605 is an SQL Injection vulnerability which can allow attackers to manipulate database queries.
Can I continue using WeGIA if I am on an affected version for now?
Using an affected version of WeGIA poses security risks and it is strongly recommended to upgrade as soon as possible.