CVE-2025-62360: WeGIA Web Manager SQLi Vulnerability

CVE-2025-62360 Overview

CVE-2025-62360 is a SQL Injection vulnerability [CWE-89] in WeGIA, an open source web manager for institutions targeted at Portuguese-speaking users. The flaw exists in the /html/funcionario/dependente_documento.php endpoint, where the id_dependente POST parameter is passed directly into a database query without sanitization. Attackers with authenticated access can inject arbitrary SQL statements, compromising the confidentiality, integrity, and availability of the underlying database. The vulnerability affects all WeGIA versions prior to 3.5.1 and is fixed in release 3.5.1.

Critical Impact
Successful exploitation allows attackers to execute arbitrary SQL commands against the WeGIA database, enabling data theft, modification of institutional records, and potential full database takeover.

Affected Products

WeGIA versions prior to 3.5.1
Component: html/funcionario/dependente_documento.php
Vendor: LabRedesCefetRJ (WeGIA)

Discovery Timeline

2025-10-13 - CVE-2025-62360 published to NVD
2025-10-20 - Last updated in NVD database

Technical Details for CVE-2025-62360

Vulnerability Analysis

The vulnerability resides in the dependente_documento.php script under the html/funcionario/ directory. The script reads the id_dependente parameter directly from the $_POST superglobal and concatenates it into an SQL query executed against the WeGIA database. Because no input filtering, type coercion, or parameterized query binding is applied, an attacker can break out of the intended query context and append arbitrary SQL clauses.

The weakness is classified as Improper Neutralization of Special Elements used in an SQL Command [CWE-89]. While the endpoint requires an authenticated session, any user with access to the affected feature can leverage the flaw to read, modify, or delete records across the database, including tables containing personally identifiable information about institutional dependents and employees.

Root Cause

The root cause is direct use of unsanitized user-controlled input in an SQL statement. The original code assigned $_POST["id_dependente"] to a variable used in a query without binding parameters or validating the value as an integer. The patch in version 3.5.1 introduces input filtering with filter_input(INPUT_POST, 'id_dependente', FILTER_SANITIZE_NUMBER_INT) and reorganizes session handling, ensuring the parameter is constrained to numeric input before reaching the database layer.

Attack Vector

Exploitation requires network access to the WeGIA web application and authenticated privileges sufficient to invoke the dependent-document endpoint. An attacker submits a crafted id_dependente POST value containing SQL syntax. The injected payload is concatenated into the query and executed by the backend, returning data or modifying state outside the intended scope.

php

// Patch excerpt — html/funcionario/dependente_documento.php
<?php
if (session_status() === PHP_SESSION_NONE) {
  session_start();
}

if (!isset($_SESSION["usuario"])) {
  header("Location: ../../index.php");
  exit();
} else {
  session_regenerate_id();
}

//Verifica permissão do usuário
require_once dirname(__FILE__, 2) . DIRECTORY_SEPARATOR . 'permissao' . DIRECTORY_SEPARATOR . 'permissao.php';
permissao($_SESSION['id_pessoa'], 11, 7);

require_once dirname(__FILE__, 3) . DIRECTORY_SEPARATOR . 'classes' . DIRECTORY_SEPARATOR . 'Util.php';
require_once  dirname(__FILE__, 3) . DIRECTORY_SEPARATOR . 'dao' . DIRECTORY_SEPARATOR . 'Conexao.php';
$pdo = Conexao::connect();

// Vulnerable: $id_dependente = $_POST["id_dependente"];
// Fixed:
$idDependente = filter_input(INPUT_POST, 'id_dependente', FILTER_SANITIZE_NUMBER_INT);

Source: GitHub Commit 7abbffd

Detection Methods for CVE-2025-62360

Indicators of Compromise

HTTP POST requests to /html/funcionario/dependente_documento.php containing SQL metacharacters in the id_dependente parameter such as single quotes, UNION, SELECT, --, or ;.
Database error messages or unusually large response bodies returned from the affected endpoint.
Authenticated WeGIA sessions issuing repeated requests to dependente_documento.php with varying non-numeric id_dependente values.

Detection Strategies

Inspect web server access logs for POST requests to dependente_documento.php where id_dependente is not a pure integer.
Deploy a web application firewall rule that blocks SQL keywords and metacharacters in the id_dependente parameter.
Enable database query auditing to flag statements referencing dependent-document tables that contain boolean-based or UNION-based injection patterns.

Monitoring Recommendations

Monitor authentication logs for sessions that access administrative endpoints shortly after login, correlating with anomalous query patterns.
Track outbound data volumes from the WeGIA database host to detect bulk extraction attempts.
Alert on database errors originating from PHP scripts under html/funcionario/, which can indicate injection probing.

How to Mitigate CVE-2025-62360

Immediate Actions Required

Upgrade WeGIA to version 3.5.1 or later, which contains the official fix for the id_dependente parameter.
Audit the WeGIA database for unauthorized modifications, new accounts, or anomalous records created prior to patching.
Rotate database credentials and any application secrets accessible to the WeGIA web tier if exploitation is suspected.

Patch Information

The vulnerability is resolved in WeGIA 3.5.1. The fix is implemented in commit 7abbffd, which applies filter_input with FILTER_SANITIZE_NUMBER_INT to the id_dependente parameter and tightens session handling. Refer to GHSA-m4j6-q5m4-x24g and GHSA-mwvv-q9gh-gwxm for advisory details, and Issue #310 for the reported behavior.

Workarounds

Restrict network access to the WeGIA application to trusted administrative users until the patch is applied.
Apply a WAF rule that rejects any POST to dependente_documento.php where id_dependente does not match ^[0-9]+$.
Reduce privileges of the database account used by WeGIA so it cannot execute DDL or access tables outside the application schema.

bash

# Example ModSecurity rule enforcing numeric id_dependente
SecRule REQUEST_URI "@endsWith /html/funcionario/dependente_documento.php" \
  "id:1062360,phase:2,deny,status:400,log,\
   chain,msg:'CVE-2025-62360 WeGIA SQLi attempt'"
  SecRule ARGS:id_dependente "!@rx ^[0-9]+$" "t:none"