CVE-2025-62177: WeGIA vulnerable to SQL Injection via 'id_funcionario' param at endpoint `/html/funcionario/dependente_listar.php`
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/dependentelistar.php endpoint, specifically in the idfuncionario parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62177?
CVE-2025-62177 is classified as a high severity SQL Injection vulnerability.
How do I fix CVE-2025-62177?
To fix CVE-2025-62177, upgrade WeGIA to version 3.5.1 or later.
Which versions of WeGIA are affected by CVE-2025-62177?
Versions of WeGIA prior to 3.5.1 are affected by CVE-2025-62177.
What type of vulnerability is CVE-2025-62177?
CVE-2025-62177 is a SQL Injection vulnerability located in the id_funcionario parameter.
In which endpoint is CVE-2025-62177 found?
CVE-2025-62177 is found in the /html/funcionario/dependente_listar.php endpoint.