SB2026043097 - SQL injection in WeGIA

Description

This security bulletin contains information about 1 vulnerability.

1) SQL injection (CVE-ID: CVE-2025-46828)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary SQL statements against the database.

The vulnerability exists due to SQL injection in the /html/socio/sistema/get_socios.php endpoint when processing the POST query parameter. A remote attacker can send a specially crafted POST request to execute arbitrary SQL statements against the database.

This may lead to data exfiltration, authentication bypass, or complete database compromise.

Remediation

Install update from vendor's website.

References

• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-5qw5-q55h-6qg7
• https://github.com/advisories/GHSA-5qw5-q55h-6qg7