CVE-2025-54079: Wegia SQL Injection Vulnerability

CVE-2025-54079 Overview

CVE-2025-54079 is a SQL Injection vulnerability in WeGIA, an open source web manager focused on Portuguese-language charitable institutions. The flaw exists in the /html/atendido/Profile_Atendido.php endpoint, specifically in the idatendido parameter. An authenticated attacker can inject arbitrary SQL queries through this parameter to access sensitive data stored in the application database. The issue affects all WeGIA versions prior to 3.4.6. The project maintainers released version 3.4.6 to remediate the vulnerability. The weakness is tracked under CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
An authorized attacker can execute arbitrary SQL queries through the idatendido parameter and exfiltrate sensitive records from the WeGIA database.

Affected Products

WeGIA versions prior to 3.4.6
Endpoint /html/atendido/Profile_Atendido.php
Parameter idatendido

Discovery Timeline

2025-07-18 - CVE-2025-54079 published to NVD
2025-07-30 - Last updated in NVD database

Technical Details for CVE-2025-54079

Vulnerability Analysis

The vulnerability resides in the Profile_Atendido.php endpoint, which accepts user-supplied input through the idatendido parameter. WeGIA passes this parameter into a SQL query without proper parameterization or sanitization. An attacker authenticated to the application can append arbitrary SQL syntax to the parameter value. The injected SQL is then executed against the backend database with the privileges of the WeGIA database user. This allows extraction of records covering registered beneficiaries, user credentials, and administrative data.

Root Cause

The root cause is improper neutralization of special elements in SQL statements ([CWE-89]). The idatendido value is concatenated into a query string instead of being bound through a prepared statement. Standard escaping routines are not applied, so quote characters and SQL operators reach the database engine intact.

Attack Vector

Exploitation requires network access to the WeGIA instance and a valid authenticated session with low privileges. The attacker submits a crafted request to /html/atendido/Profile_Atendido.php and substitutes the idatendido parameter with malicious SQL payloads. Typical payloads include UNION SELECT statements to enumerate tables and conditional time-based payloads to confirm execution. Successful exploitation breaches confidentiality, integrity, and availability of the WeGIA database. Refer to the GitHub Security Advisory GHSA-g4v3-j8w5-33v3 for advisory details.

No verified public exploit code is available at the time of writing. Defenders should treat the endpoint as exploitable given the simplicity of SQL injection in concatenated query strings.

Detection Methods for CVE-2025-54079

Indicators of Compromise

HTTP requests to /html/atendido/Profile_Atendido.php containing SQL meta-characters such as ', --, UNION, SELECT, or SLEEP in the idatendido parameter.
Database error messages or unusually long response times originating from the Profile_Atendido.php handler.
Authenticated sessions issuing repeated requests to the endpoint with varying idatendido values within short time windows.

Detection Strategies

Inspect web server access logs for requests to Profile_Atendido.php where the idatendido parameter contains non-numeric characters.
Deploy a Web Application Firewall (WAF) rule that flags SQL keywords in query and POST parameters destined for the WeGIA application.
Enable database query logging and alert on unexpected UNION, INFORMATION_SCHEMA, or SLEEP patterns issued by the WeGIA database account.

Monitoring Recommendations

Correlate authenticated user activity with anomalous database query volumes to identify low-privilege accounts probing the endpoint.
Monitor for outbound data transfers from the WeGIA host that exceed normal baselines after suspicious request patterns.
Retain web and database logs for at least 90 days to support retrospective investigation of exploitation attempts.

How to Mitigate CVE-2025-54079

Immediate Actions Required

Upgrade WeGIA to version 3.4.6 or later, which contains the official fix for the idatendido parameter.
Audit existing user accounts and rotate credentials for any account that may have accessed Profile_Atendido.php during the exposure window.
Review database contents for unauthorized modifications and confirm the integrity of beneficiary and user tables.

Patch Information

The WeGIA maintainers fixed CVE-2025-54079 in version 3.4.6. The patch and advisory are published in the LabRedesCefetRJ WeGIA GitHub Security Advisory. Operators should pull the latest tagged release and follow the standard WeGIA upgrade procedure.

Workarounds

Restrict network access to the WeGIA application to trusted administrators until the upgrade is applied.
Deploy a WAF rule that blocks requests to /html/atendido/Profile_Atendido.php when the idatendido parameter is not strictly numeric.
Reduce the privileges of the database account used by WeGIA so that successful injection cannot read or write tables outside the application schema.

bash

# Example WAF rule (ModSecurity) restricting idatendido to digits
SecRule REQUEST_URI "@beginsWith /html/atendido/Profile_Atendido.php" \
    "phase:2,chain,deny,status:400,id:1054079,msg:'CVE-2025-54079 SQLi attempt'"
    SecRule ARGS:idatendido "!@rx ^[0-9]+$" "t:none"