CVE-2025-23218: Wegia SQL Injection Vulnerability

CVE-2025-23218 Overview

CVE-2025-23218 is a SQL injection vulnerability in WeGIA, an open source web manager designed for Portuguese-language charitable institutions. The flaw resides in the adicionar_especie.php endpoint and allows unauthenticated attackers to execute arbitrary SQL commands against the backing database. Researchers demonstrated a complete database dump during exploitation, exposing all stored records. The issue is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and is fixed in WeGIA version 3.2.10.

Critical Impact
Unauthenticated attackers can extract the entire WeGIA database, including sensitive beneficiary and administrative records, by injecting SQL through the adicionar_especie.php endpoint.

Affected Products

WeGIA versions prior to 3.2.10
WeGIA deployments exposing adicionar_especie.php to network access
Charitable institution portals built on the WeGIA platform

Discovery Timeline

2025-01-20 - CVE-2025-23218 published to NVD
2025-02-28 - Last updated in NVD database

Technical Details for CVE-2025-23218

Vulnerability Analysis

The vulnerability is a SQL injection flaw reachable through the adicionar_especie.php endpoint in WeGIA. User-supplied input flows into a SQL statement without parameterization or sufficient sanitization. An attacker can append arbitrary SQL clauses, bypass query logic, and read or modify data in the underlying database.

Because the endpoint is exposed over the network and requires no authentication, exploitation can be automated with standard tooling. The disclosed proof of concept achieved a full database dump, indicating that confidentiality, integrity, and availability of stored data are all at risk.

Root Cause

The root cause is improper neutralization of special elements within SQL queries [CWE-89]. The adicionar_especie.php handler concatenates request parameters directly into a SQL statement rather than using prepared statements with bound parameters. The fix applied in commit 7465f78 introduces input handling that prevents attacker-controlled data from altering query structure.

Attack Vector

An attacker sends a crafted HTTP request to adicionar_especie.php containing SQL metacharacters in a vulnerable parameter. The injected payload terminates the original statement and appends attacker-controlled SQL, such as UNION SELECT queries to extract table contents. No credentials, user interaction, or prior foothold are required. See the GitHub Security Advisory GHSA-xhv4-88gx-hvgh for additional context.

Detection Methods for CVE-2025-23218

Indicators of Compromise

HTTP requests to /html/socio/adicionar_especie.php containing SQL metacharacters such as single quotes, UNION SELECT, --, or /*
Unusual database error responses returned from WeGIA following requests to the affected endpoint
Outbound queries reading from information_schema tables originating from the WeGIA database user
Sudden spikes in response size from adicionar_especie.php consistent with bulk data extraction

Detection Strategies

Inspect web server access logs for requests to adicionar_especie.php containing encoded or raw SQL syntax
Deploy Web Application Firewall (WAF) rules that flag SQL injection patterns targeting WeGIA endpoints
Enable database query logging to identify unexpected UNION, SLEEP, or information_schema access from the application service account

Monitoring Recommendations

Alert on repeated 500-series HTTP responses from WeGIA endpoints, which often indicate injection probing
Monitor for anomalous outbound data volumes from servers hosting WeGIA
Track authentication-less access patterns across /html/socio/ paths for reconnaissance behavior

How to Mitigate CVE-2025-23218

Immediate Actions Required

Upgrade WeGIA to version 3.2.10 or later, which contains the fix from commit 7465f78
Restrict network exposure of the WeGIA application to trusted networks until patching is complete
Rotate database credentials and review database contents for evidence of unauthorized access
Audit application and database logs covering the period before the upgrade for injection attempts

Patch Information

The vulnerability is remediated in WeGIA 3.2.10. The corrective change is published as commit 7465f78 in the LabRedesCefetRJ/WeGIA repository. Administrators should pull the tagged release and redeploy rather than backporting partial fixes.

Workarounds

Place WeGIA behind a Web Application Firewall with SQL injection signatures enabled
Block external access to adicionar_especie.php at the reverse proxy until the patch is applied
Apply least-privilege grants to the database account used by WeGIA, removing rights beyond required tables

bash

# Configuration example: restrict access to the vulnerable endpoint at the reverse proxy
location ~* /html/socio/adicionar_especie\.php$ {
    allow 10.0.0.0/8;
    deny all;
    return 403;
}