CVE-2025-59939: Wegia SQL Injection Vulnerability

CVE-2025-59939 Overview

CVE-2025-59939 is a SQL Injection vulnerability in WeGIA, an open-source web manager for charitable institutions. The flaw resides in the control.php endpoint, where the id_produto parameter is concatenated into a SQL query without sanitization or parameterization [CWE-89]. Authenticated attackers can inject arbitrary SQL through the request nomeClasse=ProdutoControle&metodo=excluir&id_produto=[payload]. The vulnerability affects all WeGIA versions prior to 3.5.0 and has been patched in version 3.5.0.

Critical Impact
Attackers with low-privilege access can execute arbitrary SQL queries against the WeGIA backend database, leading to full compromise of confidentiality, integrity, and availability of stored institutional data.

Affected Products

WeGIA versions prior to 3.5.0
Vendor: LabRedesCefetRJ (WeGIA project)
Component: wegia:wegia

Discovery Timeline

2025-09-27 - CVE-2025-59939 published to NVD
2025-10-06 - Last updated in NVD database

Technical Details for CVE-2025-59939

Vulnerability Analysis

The vulnerability is a classic SQL Injection [CWE-89] in the WeGIA control.php request handler. When the application processes the ProdutoControle class with the excluir method, the id_produto parameter flows directly into a database query. The application does not apply prepared statements, parameter binding, or input validation on this value.

An attacker submitting a crafted id_produto payload can break out of the intended query context and append arbitrary SQL clauses. Because the affected method performs a delete operation, attackers can manipulate WHERE conditions, chain UNION selects, or trigger time-based blind extraction. The result is full read and write access to the underlying database.

Exploitation requires network access to the application and a low-privilege authenticated session, but no user interaction is needed.

Root Cause

The root cause is unsafe concatenation of user-controlled input into a SQL statement. The id_produto parameter is treated as a trusted integer identifier without type casting, allowlist validation, or use of parameterized queries through PDO or mysqli prepared statements.

Attack Vector

The attack vector is a network-reachable HTTP request to the WeGIA application. An authenticated attacker sends a request to control.php with the parameters nomeClasse=ProdutoControle, metodo=excluir, and a malicious id_produto payload. The server executes the injected SQL within the privileges of the WeGIA database user.

The vulnerability is exploitable in standard deployments without bypassing additional controls. No verified public proof-of-concept is listed in the references beyond the GitHub Security Advisory.

Detection Methods for CVE-2025-59939

Indicators of Compromise

HTTP requests to control.php containing nomeClasse=ProdutoControle and metodo=excluir with non-numeric or SQL meta-characters in the id_produto parameter.
Web server access logs showing URL-encoded SQL keywords such as UNION, SELECT, SLEEP, --, %27, or 0x adjacent to id_produto.
Database error messages or unexpected DELETE, SELECT, or INFORMATION_SCHEMA queries originating from the WeGIA application user.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query strings to control.php and flag SQL metacharacters in the id_produto parameter.
Enable database query logging and alert on queries containing tautologies (OR 1=1), UNION SELECT, or SLEEP() calls from the WeGIA service account.
Correlate authentication events with anomalous request volumes against the ProdutoControle controller.

Monitoring Recommendations

Forward web server and database logs to a centralized analytics platform and baseline normal id_produto values, which should be integers only.
Alert on HTTP 500 responses from control.php, which often indicate failed injection attempts that reveal database errors.
Monitor outbound connections from the WeGIA host for signs of data exfiltration following suspicious query activity.

How to Mitigate CVE-2025-59939

Immediate Actions Required

Upgrade WeGIA to version 3.5.0 or later, which contains the official patch.
Restrict access to the WeGIA application to trusted networks or VPN users while the upgrade is being scheduled.
Rotate database credentials used by WeGIA if logs show evidence of injection attempts.
Review existing user accounts and audit recent product deletion or modification events for tampering.

Patch Information

The WeGIA maintainers fixed the issue in version 3.5.0 by introducing prepared statements, sanitization, and validation on the id_produto parameter in the ProdutoControle::excluir flow. Refer to the GitHub Security Advisory GHSA-jx9m-pgf8-v489 for patch details.

Workarounds

If immediate upgrade is not possible, deploy a WAF rule that rejects requests to control.php where id_produto is not strictly numeric.
Restrict the WeGIA database account to the minimum privileges required, removing rights to access INFORMATION_SCHEMA or perform FILE operations.
Disable or firewall the ProdutoControle endpoint at the reverse proxy until patching is complete.

bash

# Example NGINX rule rejecting non-numeric id_produto values
location = /control.php {
    if ($arg_id_produto !~ "^[0-9]+$") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}