CVE-2025-22140: Wegia SQL Injection Vulnerability

CVE-2025-22140 Overview

CVE-2025-22140 is a SQL Injection vulnerability in WeGIA, an open-source web manager used by charitable institutions. The flaw resides in the /html/funcionario/dependente_listar_um.php endpoint and affects the id_dependente parameter, which is concatenated into a SQL query without proper sanitization. Authenticated attackers can inject arbitrary SQL statements to read, modify, or destroy data in the underlying database. The issue is tracked as [CWE-89] and was fixed in WeGIA version 3.2.8.

Critical Impact
Successful exploitation compromises database confidentiality, integrity, and availability, and may expose sensitive records held by charitable institutions.

Affected Products

WeGIA versions prior to 3.2.8
Endpoint: /html/funcionario/dependente_listar_um.php
Parameter: id_dependente

Discovery Timeline

2025-01-08 - CVE-2025-22140 published to the National Vulnerability Database (NVD)
2025-04-09 - Last updated in NVD database

Technical Details for CVE-2025-22140

Vulnerability Analysis

The vulnerability is a classic SQL Injection issue in a PHP endpoint. The dependente_listar_um.php script accepts the id_dependente HTTP parameter and inserts it into a SQL query without parameterization or input validation. Attackers supply crafted values that break out of the intended query context and append arbitrary SQL clauses.

Because the endpoint executes against the application database, attackers can extract employee and dependent records, modify records, or drop tables. The vulnerability carries an EPSS probability of 0.673% (percentile 47.1), reflecting moderate near-term exploitation likelihood for an open-source web application.

Root Cause

The root cause is direct concatenation of user-controlled input into a SQL statement. The PHP code does not use prepared statements, parameter binding, or type casting on the id_dependente value. This pattern is mapped to [CWE-89]: Improper Neutralization of Special Elements used in an SQL Command.

Attack Vector

The attack is remote and requires only low privileges (an authenticated session in WeGIA). An attacker sends an HTTP request to /html/funcionario/dependente_listar_um.php with a malicious id_dependente value containing SQL metacharacters such as single quotes, UNION SELECT clauses, or stacked queries. The injected payload is executed by the backend database engine. See the GitHub Security Advisory GHSA-mrhp-wfp2-59h5 for additional technical context.

Detection Methods for CVE-2025-22140

Indicators of Compromise

HTTP requests to /html/funcionario/dependente_listar_um.php containing SQL metacharacters in the id_dependente parameter, such as ', --, ;, UNION, or SELECT.
Database error messages or unusually long response times correlated with requests to the affected endpoint.
Unexpected SELECT activity against employee, dependent, or authentication tables originating from the WeGIA application user.

Detection Strategies

Inspect web server access logs for non-numeric values in the id_dependente query parameter, since the field should contain only integer identifiers.
Enable database query logging and alert on queries against the WeGIA schema that contain UNION, INFORMATION_SCHEMA, or stacked statements.
Deploy a Web Application Firewall (WAF) signature for SQL Injection patterns targeting the dependente_listar_um.php path.

Monitoring Recommendations

Forward WeGIA web and database logs to a centralized SIEM and correlate authentication events with anomalous query patterns.
Monitor for bulk data reads from the dependents and employees tables outside of normal business workflows.
Track outbound network connections from the WeGIA host that may indicate data exfiltration following exploitation.

How to Mitigate CVE-2025-22140

Immediate Actions Required

Upgrade WeGIA to version 3.2.8 or later, which contains the official fix.
Audit recent access logs for the /html/funcionario/dependente_listar_um.php endpoint and investigate any non-integer id_dependente values.
Rotate database credentials and application session secrets if exploitation is suspected.

Patch Information

The maintainers patched the issue in WeGIA 3.2.8. Patch details and remediation guidance are documented in the GitHub Security Advisory GHSA-mrhp-wfp2-59h5.

Workarounds

Restrict access to the WeGIA application to trusted networks or VPN users until the patch is deployed.
Deploy WAF rules that reject requests where id_dependente is non-numeric or contains SQL metacharacters.
Apply least-privilege permissions to the database account used by WeGIA so that injected queries cannot modify schema or access unrelated tables.

bash

# Example WAF rule (ModSecurity) to block non-numeric id_dependente values
SecRule REQUEST_URI "@contains /html/funcionario/dependente_listar_um.php" \
  "chain,deny,status:400,id:1002201,msg:'WeGIA CVE-2025-22140 SQLi attempt'"
  SecRule ARGS:id_dependente "!@rx ^[0-9]+$" "t:none"