SQL Injection Vulnerability in WeGIA Web Manager by LabRedesCefetRJ
CVE-2025-53091

10CRITICAL

Key Information:

Vendor

Labredescefetrj

Status
Wegia
Vendor
CVE Published:
27 June 2025

What is CVE-2025-53091?

A Time-Based Blind SQL Injection vulnerability has been identified in WeGIA, an open-source web management tool focused on charitable organizations in Portuguese. Specifically, this flaw exists within the 'almox' parameter of the '/controle/getProdutosPorAlmox.php' endpoint in version 3.3.3. If exploited, it allows unauthenticated attackers to inject arbitrary SQL queries into the database, potentially gaining access to sensitive data based on the database's configuration. Users are encouraged to upgrade to version 3.4.0, which resolves this critical security issue.

Affected Version(s)

WeGIA = 3.3.3

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisor...
x_refsource_CONFIRM

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-53091 : SQL Injection Vulnerability in WeGIA Web Manager by LabRedesCefetRJ