External risk intelligence

WeGIA SQL Injection Vulnerability in Editar Categoria Endpoint

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2025-67501

WeGIA is a web-based management application intended for institutional use. Such applications are commonly deployed as internet-facing web portals or internal services reachable via a browser. While the specific endpoint requires administrative privileges, the nature of the software as a web management interface makes it a likely target for external or authorized network access in typical deployment scenarios.

SQL Injection

Wegia

before 3.5.5

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the WeGIA open source web manager, a tool focused on Portuguese language users. The issue involves improper handling of user input, creating a pathway for attackers to inject malicious SQL commands. This could allow unauthorized access and manipulation of the underlying data.

SQL injection flaw in web manager.
Affects institutional data management.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker with administrative access to WeGIA can target the endpoint that manages categories. By providing specially crafted input in the `id_categoria` parameter, an attacker can trick the application into executing arbitrary SQL commands, potentially leading to unauthorized access to or modification of sensitive data.

Requires authenticated administrative access.
Exploited through the category management endpoint.
Risk of unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, the `id_categoria` parameter in WeGIA's `/html/matPat/editar_categoria.php` endpoint could allow unauthorized SQL commands to be executed. This might occur when an authenticated user, with administrative privileges, interacts with the category editing functionality. The advisory does not specify the types of data at risk.

Institution data.
SQL injection via parameter.
Unauthorized data access or manipulation.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners are responsible for managing WeGIA instances. The first step is to inventory all WeGIA deployments, assess their exposure and criticality, and identify the system owner for each. Once identified, plan remediation by coordinating with the vendor or applying the latest version during the next maintenance window.

Identify WeGIA instances and owners.
Verify reachability and business criticality.
Plan vendor-coordinated updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WeGIA and how is it used?

WeGIA is an open-source web-based management platform designed to help institutions organize their operations, particularly for users in Portuguese-speaking regions. It functions as a centralized portal for administrative tasks, allowing staff to manage institutional data through a browser interface. Because it handles core organizational information, it is typically deployed as a web application hosted either on an internal network or exposed to the internet to facilitate remote access for authorized...

What does SQL injection mean for CVE-2025-67501?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain English, the software takes information typed into a specific field and incorrectly processes it as part of a database command rather than as simple text. This flaw allows an attacker to 'inject' their own malicious instructions into the database query, potentially tricking the system into exposing, modifying, or deleting the information it manages.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by interacting with the specific category editing endpoint. The vulnerability relies on the application failing to properly clean the 'id_categoria' parameter. Importantly, this issue does not occur during standard, legitimate use of the interface when the input is benign. It specifically requires an attacker to send a specially crafted request containing malicious SQL syntax to that targeted parameter to manipulate the application's underlying database interactions.

Who should be concerned about this WeGIA vulnerability?

Any organization running WeGIA versions 3.5.4 or earlier should assess their setup. According to Halo Surface Signal, because WeGIA is a web management application, it is commonly found in environments where the interface is either directly accessible from the internet or reachable across internal networks. Even though the endpoint requires administrative privileges, the software's typical role as a reachable management portal makes it a primary point of concern for system administrators.

What steps should I take if I use WeGIA?

Begin by identifying all running instances of WeGIA within your environment and confirming which version is installed. If you are using any version 3.5.4 or older, prioritize updating to version 3.5.5, which contains the fix for this issue. Coordinate this update with your system owners and plan the deployment during your next scheduled maintenance window to ensure service continuity while eliminating the vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.