CVE-2025-62179: WeGIA SQL Injection via 'cpf' param at endpoint `/html/funcionario/cadastro_funcionario_pessoa_existente.php`
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/cadastrofuncionariopessoaexistente.php endpoint, specifically in the cpf parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62179?
CVE-2025-62179 is classified as a high severity vulnerability due to its potential for SQL injection.
How do I fix CVE-2025-62179?
To fix CVE-2025-62179, upgrade WeGIA to version 3.5.1 or later.
What type of vulnerability is CVE-2025-62179?
CVE-2025-62179 is a SQL Injection vulnerability affecting WeGIA before version 3.5.1.
Which software versions are affected by CVE-2025-62179?
CVE-2025-62179 affects all versions of WeGIA prior to 3.5.1.
Where does CVE-2025-62179 occur in WeGIA?
CVE-2025-62179 occurs in the /html/funcionario/cadastro_funcionario_pessoa_existente.php endpoint, specifically in the cpf parameter.