CVE-2025-24901 Overview
CVE-2025-24901 is a SQL injection vulnerability [CWE-89] in WeGIA, an open-source web manager for charitable institutions developed by LabRedesCefetRJ. The flaw resides in the deletar_permissao.php endpoint, which fails to properly sanitize user-supplied input before passing it to SQL queries. An authenticated attacker can inject arbitrary SQL statements through this endpoint. Successful exploitation allows the attacker to read, modify, or delete sensitive records stored in the application database. The maintainers fixed the issue in WeGIA version 3.2.12.
Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WeGIA backend, exposing or destroying sensitive institutional and beneficiary data.
Affected Products
- WeGIA (LabRedesCefetRJ) all versions prior to 3.2.12
- Endpoint: deletar_permissao.php
- Deployments using WeGIA as a charitable institution management platform
Discovery Timeline
- 2025-02-03 - CVE-2025-24901 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24901
Vulnerability Analysis
The vulnerability stems from improper neutralization of special elements used in an SQL command within the deletar_permissao.php endpoint. The endpoint accepts a parameter that is concatenated directly into a SQL DELETE or related query without parameterization or input validation. Because the application uses dynamic SQL construction, an attacker can break out of the intended query context and append arbitrary SQL clauses.
WeGIA requires authentication to reach the affected endpoint, but the privilege level required is low. Any authenticated user able to invoke permission management functionality can deliver the payload. Once injected, the SQL engine executes attacker-controlled statements with the privileges of the WeGIA database account, which typically holds broad access to institutional data.
The scope of impact extends across confidentiality, integrity, and availability. Attackers can extract beneficiary records, alter permission tables to escalate their own access, or destroy data through DROP or DELETE statements. Refer to the GitHub Security Advisory GHSA-jp48-94wm-3gmc for the maintainer's analysis.
Root Cause
The root cause is the construction of SQL queries through string concatenation with unsanitized HTTP request parameters in deletar_permissao.php. The code path does not use prepared statements or parameter binding offered by PHP's PDO or mysqli extensions.
Attack Vector
The attack vector is network-based over HTTP/HTTPS. An authenticated attacker sends a crafted request to deletar_permissao.php containing SQL metacharacters in the targeted parameter. No user interaction beyond the attacker's own session is required.
No verified public proof-of-concept code is available. See the vendor advisory linked above for technical context.
Detection Methods for CVE-2025-24901
Indicators of Compromise
- HTTP requests to /html/permissao/deletar_permissao.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ;
- Unexpected entries removed from or added to the WeGIA permissions tables
- Database error messages referencing syntax errors logged by the PHP application during authenticated user sessions
- Anomalous data exfiltration patterns from the WeGIA database host
Detection Strategies
- Inspect web server access logs for requests to deletar_permissao.php with abnormally long query strings or encoded SQL keywords
- Enable database query logging and alert on DELETE, UNION SELECT, or INFORMATION_SCHEMA references originating from the WeGIA application user
- Deploy a web application firewall (WAF) rule set covering OWASP CRS SQL injection signatures in front of WeGIA
- Review authentication logs to correlate suspicious endpoint activity with specific user accounts
Monitoring Recommendations
- Forward web server and PHP error logs to a centralized log analytics platform for correlation with database events
- Monitor the WeGIA MySQL or MariaDB instance for spikes in query volume or schema enumeration attempts
- Alert on changes to the permissao table outside of approved administrative workflows
- Track file integrity for PHP source files under the WeGIA web root to detect unauthorized modifications following exploitation
How to Mitigate CVE-2025-24901
Immediate Actions Required
- Upgrade WeGIA to version 3.2.12 or later, which contains the official fix from LabRedesCefetRJ
- Audit existing user accounts and revoke any unfamiliar or inactive accounts that could be used to reach the vulnerable endpoint
- Review database logs since deployment of vulnerable versions for evidence of injection attempts or unauthorized data access
- Rotate database credentials and application secrets if compromise is suspected
Patch Information
The maintainer addressed the vulnerability in WeGIA version 3.2.12. Administrators should pull the updated release from the LabRedesCefetRJ WeGIA repository and redeploy. The fix introduces proper input handling in deletar_permissao.php to prevent injection of SQL control characters.
Workarounds
- No vendor-supplied workarounds are available; upgrading is the only supported remediation
- As a temporary compensating control, restrict network access to the WeGIA application to trusted administrative networks
- Place a WAF in front of WeGIA with SQL injection rules enabled until the patch is applied
# Upgrade WeGIA to a patched release
cd /var/www/wegia
git fetch --tags
git checkout 3.2.12
# Restart the web server after deployment
sudo systemctl restart apache2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
