CVE-2025-23219: Wegia SQL Injection Vulnerability

CVE-2025-23219 Overview

CVE-2025-23219 is a critical SQL Injection vulnerability discovered in WeGIA, an open source web manager designed with a focus on the Portuguese language and charitable institutions. The vulnerability exists in the adicionar_cor.php endpoint, which allows attackers to execute arbitrary SQL commands against the database without authentication. Successful exploitation enables unauthorized access to sensitive information, including the ability to perform a complete database dump.

Critical Impact

Unauthenticated attackers can execute arbitrary SQL queries to extract, modify, or delete all data from the WeGIA database, potentially compromising sensitive information of charitable institutions.

Affected Products

• WeGIA versions prior to 3.2.10
• WeGIA adicionar_cor.php endpoint in dao/pet/ directory
• All installations with network-accessible WeGIA instances

Discovery Timeline

• 2025-01-20 - CVE-2025-23219 published to NVD
• 2025-02-28 - Last updated in NVD database

Technical Details for CVE-2025-23219

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) exists due to improper input validation in the adicionar_cor.php file. The vulnerable code directly concatenates user-supplied input into a SQL query string without any sanitization or parameterization, creating a classic SQL Injection attack surface. The vulnerability is network-accessible and requires no authentication or user interaction, making it trivially exploitable by remote attackers.

The attack allows complete compromise of the database confidentiality, integrity, and availability. During testing, researchers demonstrated the ability to perform a full database dump, underscoring the severe risk posed to organizations running vulnerable WeGIA installations.

Root Cause

The root cause is the direct concatenation of user-controlled input from $_POST["cor"] into a raw SQL query string. The original code executed the query directly via $pdo->query($sql) without using prepared statements or input sanitization, allowing malicious SQL syntax to be injected and executed.

Attack Vector

The attack vector is network-based, targeting the adicionar_cor.php endpoint with a malicious POST request. An attacker can craft a payload in the cor parameter that escapes the intended string context and injects additional SQL commands. Since the endpoint lacked authentication controls, any network-adjacent or remote attacker with access to the WeGIA instance could exploit this vulnerability.

The following patch demonstrates the vulnerable code and its fix:

// VULNERABLE CODE (before patch):
<?php
require_once'../Conexao.php';
$pdo = Conexao::connect();
$cor = $_POST["cor"];

$sql = "INSERT INTO pet_cor(descricao) values('" .$cor ."')";
$pdo->query($sql);
?>

// PATCHED CODE (after fix):
<?php
require_once '../Conexao.php';
require_once '../../html/permissao/permissao.php';
permissao($_SESSION['id_pessoa'], 6, 3);

$cor = filter_input(INPUT_POST, 'cor', FILTER_SANITIZE_STRING);
try {
    $pdo = Conexao::connect();
    $sql = "INSERT INTO pet_cor(descricao) values(:cor)";
    $stmt = $pdo->prepare($sql);
    $stmt->bindParam(':cor', $cor);
} catch (PDOException $e) {
    http_response_code(500);
    echo json_encode(['erro' => 'Erro no servidor ao inserir a cor do pet.']);
    exit();
}

Source: GitHub Commit Overview

Detection Methods for CVE-2025-23219

Indicators of Compromise

• Anomalous HTTP POST requests to /dao/pet/adicionar_cor.php containing SQL syntax characters such as single quotes, semicolons, or UNION SELECT statements
• Database query logs showing unexpected or malformed queries originating from the pet_cor table operations
• Evidence of bulk data extraction or database enumeration activity in database audit logs
• Web server logs containing encoded SQL injection payloads in the cor POST parameter

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in POST parameters targeting the adicionar_cor.php endpoint
• Enable database query logging and alerting for queries with suspicious patterns such as UNION, SELECT * FROM, or time-based blind injection indicators
• Monitor for unusual database response times that may indicate time-based SQL injection attacks
• Implement intrusion detection system (IDS) signatures for SQL injection attack patterns

Monitoring Recommendations

• Configure real-time alerting for HTTP requests to adicionar_cor.php with payloads exceeding normal parameter lengths or containing non-alphanumeric characters
• Monitor database accounts used by WeGIA for unusual query patterns or access to tables outside normal application behavior
• Review web server access logs for repeated requests to the vulnerable endpoint from the same IP address

How to Mitigate CVE-2025-23219

Immediate Actions Required

• Upgrade WeGIA to version 3.2.10 or later immediately to remediate this vulnerability
• If immediate patching is not possible, restrict network access to the vulnerable endpoint using firewall rules or web server configuration
• Audit database logs for evidence of prior exploitation and potential data exfiltration
• Rotate database credentials as a precautionary measure

Patch Information

WeGIA has released version 3.2.10 which addresses this SQL Injection vulnerability. The fix implements prepared statements with parameterized queries using PDO bindParam(), adds input sanitization via filter_input(), and introduces authentication checks via the permissao() function. For detailed patch information, refer to the GitHub Security Advisory GHSA-h2mg-4c7q-w69v and the associated commit.

Workarounds

• Block access to the adicionar_cor.php endpoint at the web server or reverse proxy level until patching is complete
• Implement a Web Application Firewall rule to filter POST requests containing SQL injection patterns in the cor parameter
• Restrict access to the WeGIA administrative interface to trusted IP addresses only

# Apache configuration to block access to the vulnerable endpoint
<Location "/dao/pet/adicionar_cor.php">
    Require ip 10.0.0.0/8 192.168.0.0/16
</Location>

# Nginx configuration to block access
location /dao/pet/adicionar_cor.php {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}