Overview
WeGIA, a popular open source web manager with a focus on charitable institutions, has been reported to have a severe SQL Injection vulnerability in its versions 3.4.12 and below. The vulnerability, identified by the CVE identifier CVE-2025-61605, is located in the /pet/profile_pet.php endpoint, specifically in the id_pet parameter. This vulnerability is of significant concern, as it allows attackers to execute arbitrary SQL commands, potentially compromising the confidentiality, integrity, and availability of WeGIA’s databases. This could lead to significant data loss or exposure for charities and other institutions using WeGIA’s web management system.
Vulnerability Summary
CVE ID: CVE-2025-61605
Severity: Critical (CVSS: 9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
WeGIA Web Manager | 3.4.12 and below
How the Exploit Works
The SQL Injection vulnerability in WeGIA web manager is due to improper neutralization of special elements used in an SQL command. Specifically, the vulnerability is located in the id_pet parameter of the /pet/profile_pet.php endpoint. Attackers can abuse this flaw by injecting arbitrary SQL code into the id_pet parameter. This could give an attacker the ability to view, modify, or delete data, potentially leading to unauthorized disclosure of information, unauthorized modification, and disruption of the affected system.
Conceptual Example Code
Here is a hypothetical example of how an attacker could exploit this vulnerability. This example assumes that the attacker has already identified the /pet/profile_pet.php endpoint and knows that the id_pet parameter is vulnerable to SQL injection.
GET /pet/profile_pet.php?id_pet=1 OR 1=1; -- HTTP/1.1
Host: target.example.comIn this example, `1 OR 1=1; –` is the injected SQL statement. This statement is always true, which means that the query will return all the pet profiles stored in the database. The `–` symbol is an SQL comment, so everything after this symbol will be ignored, effectively neutralizing the rest of the original SQL command. This could potentially allow the attacker to extract sensitive data from the database.
As always, this conceptual code is provided to help system administrators and security professionals understand the vulnerability and should not be used for malicious purposes.
