CVE-2025-62360

published 2025-10-13

CVE-2025-62360: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.Prior to 3.5.1, a SQL Injection vulnerability was identified in…

Priority P2 66 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_documento.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.5.1.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
labredescefetrj	wegia	< 3.5.1	3.5.1
wegia	wegia	< 3.5.1	3.5.1

Detection & IOCs extracted from sources · hover to see the quote

url /html/funcionario/dependente_documento.php↗

command id_dependente=1 UNION+SELECT 'a','b',$payload;#↗

path /html/login.php↗

• → Monitor POST requests to /html/funcionario/dependente_documento.php for SQL injection patterns in the id_dependente parameter, particularly UNION SELECT payloads. ↗
• → Detect POST body containing 'id_dependente=' with UNION SELECT or comment terminators (;#) as indicators of active exploitation attempts. ↗
• → The exploit authenticates first via /html/login.php using multipart form POST (cpf/pwd fields) and then reuses the session cookie for the injection request; correlate login events followed immediately by requests to dependente_documento.php. ↗
• → Successful exploitation returns HTTP 200 with a JSON body containing an 'id_doc' field populated with the injected SQL result (e.g. database version string); alert on unexpected values in this field. ↗
• → Content-Type header 'application/x-www-form-urlencoded' is used for the injection request; inspect POST bodies with this content type to the vulnerable endpoint. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89