WeGIA vulnerabilities

WeGIA is a web manager for charitable institutions. Prior to version 3.6.2, an authenticated SQL Injection vulnerability was identified in the Atendido_ocorrenciaControle endpoint via the id_memorando parameter. This flaw allows for full database exfiltration, exposure of sensitive PII, and potential arbitrary file reads in misconfigured environments. This vulnerability is fixed in 3.6.2.

In WeGIA prior to 3.8.6, the unauthenticated cadastro_cobrancas_geracao.php endpoint accepts POST data via extract($_REQUEST) and inserts it directly into an INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data, or delete database tables.

In WeGIA prior to 3.8.6, the unauthenticated cadastro_cobranca.php endpoint accepts POST input via extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can execute arbitrary SQL to read or modify WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data.

In WeGIA prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table.

In WeGIA (a web manager for charitable institutions) prior to 3.8.5, the deletar_socios.php endpoint is accessible without authentication, and its chave parameter is checked only against a hardcoded value embedded in the public repository. An attacker who knows that value can trigger TRUNCATE TABLE operations on the endereco, pessoafisica, pessoajuridica, and socio tables, permanently destroying member and contributor records.

In WeGIA prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive ContribuicaoLogController operations from authentication, and constructs a controller include path without canonical directory containment. An unauthenticated attacker can invoke sensitive methods, disclose contribution and donation records, trigger financial operations, and include files outside the intended controller directory.

WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the WeGIA system, specifically within the html/memorando/insere_despacho.php file. The application fails to properly sanitize or encode user-supplied input via the id_memorando GET parameter before reflecting it into the HTML source (likely inside a <script> block or an attribute). This allows unauthenticated attackers to inject arbitrary JavaScript or HTML into the context of the user's browser session. This vulnerability is fixed in 3.6.2.

WeGIA versions 3.4.12 and below contain an SQL Injection vulnerability in the /pet/profile_pet.php endpoint, specifically in the id_pet parameter, allowing attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue is fixed in version 3.5.0.

WeGIA versions 3.4.12 and below include an SQL Injection vulnerability in the /controle/control.php endpoint, specifically in the descricao parameter, allowing attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue is fixed in version 3.5.0.

WeGIA versions prior to 3.4.11 remain vulnerable to arbitrary file upload because the fix for CVE-2025-22133 was insufficient. The application only checks MIME types for Excel files at /html/socio/sistema/controller/controla_xlsx.php, which can be bypassed using Excel magic bytes in a PHP file, allowing webshell upload and remote code execution.

WeGIA versions prior to 3.4.11 contain a remote code execution vulnerability caused by improper validation of uploaded files. The application allows uploading files with arbitrary filenames, including .php extensions, which are written directly to disk without adequate sanitization, enabling PHP code execution on the server.

WeGIA prior to 3.8.7 has a stored cross-site scripting vulnerability in saude/historico_prontuarios.php because the textoProntuario field accepts arbitrary HTML or JavaScript without proper sanitization. Stored content is rendered and executed in another user's browser when viewing a patient's medical record history.

WeGIA prior to 3.8.7 has a stored DOM cross-site scripting vulnerability in web/html/memorando/listar_despachos.php resulting from unsafe handling of the texto field. FILTER_SANITIZE_SPECIAL_CHARS is applied during storage, but html_entity_decode() later decodes the content and jQuery .html() inserts the result into the DOM.

In WeGIA before version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters via extract($_REQUEST), and the affected Controle CRUD methods do not verify record ownership. Any authenticated user can view, modify, or delete another user's records, exposing CPF, RG, addresses, medical records, financial data, and employee records. Additionally, AtendidoControle and InternoControle lack CSRF validation.

Prior to 3.8.6, WeGIA's auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute.

Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables, allowing arbitrary SQL execution.

In WeGIA prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(), and the installer writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement.

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in web/controle/InternoControle.php, including listarUm, alterar, and excluir, accept user-controlled id or idInterno values without verifying ownership, allowing a low-privileged user to read, modify, or delete another person's records and expose personal, identity, address, medical, and family information. The advisory notes that a self-referencing load bug can crash this controller in the reported revision, but the empty-resource authorization pattern and affected methods remain the vulnerability under review. This issue is fixed in version 3.8.5.

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an id_pessoa parameter through a request extraction function that overwrites the session-derived identifier. Attackers can enumerate all user identifiers to retrieve full profile data for any employee account, including name, CPF, address, contact details, and administrative flags.

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover.

In WeGIA prior to 3.7.3, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint through the nextPage parameter combined with metodo=listarTodos and nomeClasse=InternoControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This vulnerability is fixed in 3.7.3.

In WeGIA versions prior to 3.7.3, html/login.php hashes the submitted password using PHP's hash() function with SHA-256 and no salt before comparing it to the stored value. The password change flow in controle/FuncionarioControle.php follows the same pattern. SHA-256 is a general-purpose cryptographic hash built for speed, not password storage; without a salt, identical passwords produce identical digests, making the entire hash database vulnerable to a single precomputed rainbow table lookup. This vulnerability is fixed in 3.7.3.

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Processo de Aceitação (html/atendido/processo_aceitacao.php) page, which is executed when a user accesses the page, enabling session hijacking and account takeover. This vulnerability is fixed in 3.7.3.

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the "Etapas de um Processo" (html/atendido/etapa_processo.php) page, which is executed when a user accesses the page, enabling session hijacking and account takeover. This vulnerability is fixed in 3.7.3.

In WeGIA versions prior to 3.6.10, uploading a file with malicious content to funcionario/docdependente_upload.php returns an overly descriptive error message. This leads to information disclosure and increases the attack surface.

WeGIA versions prior to 3.7.0 contain a reflected Cross-Site Scripting (XSS) vulnerability in lista_arquivos_etapa.php. The id_processo parameter is embedded directly into HTML without sanitization, allowing injection of arbitrary JavaScript.

In WeGIA versions prior to 3.7.0, a Stored Cross-Site Scripting (XSS) flaw was identified at the funcionario/profile_funcionario.php endpoint. Injecting a malicious payload into the 'Description' field and saving the profile persistently stores the script, which executes whenever the profile page is accessed.

In WeGIA prior to version 3.7.0, atendido/familiar_docfamiliar.php displays an overly descriptive error message including database-related details. This verbosity leads to information disclosure that could help an attacker map the backend infrastructure and expand the attack surface. The vulnerability is fixed in version 3.7.0.

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript via the "Destinatário" field; the payload is stored and later executed when viewing the dispatch page, impacting other users. Version 3.6.10 fixes the issue.

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Intercorrências notification page, which is executed when a user accesses the page, enabling session hijacking and account takeover. Version 3.6.10 fixes the issue.

WeGIA versions prior to 3.6.10 contain a stored XSS vulnerability that allows an authenticated user to inject malicious JavaScript via the "Nome" field on the "Informações Pacientes" page. The payload is stored and executed when patient information is viewed. Version 3.6.10 fixes the issue.

WeGIA prior to version 3.6.9 contains an open redirect vulnerability. The 'redirect' parameter taken from the GET request is not validated or whitelisted, then used directly in a Location header. An attacker can redirect users to a malicious site.

WeGIA before version 3.6.9 contains an open redirect vulnerability. The 'redirect' parameter is taken directly from $_GET without URL validation and used in a Location header, allowing redirection to arbitrary external sites.

WeGIA before version 3.6.9 has an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the 'nextPage' parameter. The application fails to validate this parameter, allowing attackers to redirect users to arbitrary external sites.

WeGIA before version 3.6.9 contains an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter when combined with metodo=listarTodos and nomeClasse=EstoqueControle. The parameter is not validated, allowing redirection to arbitrary external websites.

WeGIA before 3.6.9 has a stored XSS vulnerability via a backup filename. An attacker can inject malicious scripts that execute in the victim's browser.

WeGIA prior to 3.6.9 has an Open Redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter. The application fails to validate the parameter, allowing redirection to arbitrary external sites.

WeGIA before version 3.6.9 contains an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter when combined with metodo=listarId and nomeClasse=IsaidaControle. The parameter is not validated, allowing redirection to arbitrary external websites.

WeGIA (Web manager for charitable institutions) versions prior to 3.6.9 contain a SQL injection vulnerability in dao/memorando/DespachoDAO.php. The id_memorando parameter is extracted from $_REQUEST without validation and directly interpolated into SQL queries, allowing any authenticated user to execute arbitrary SQL commands against the database. This vulnerability is fixed in version 3.6.9.

WeGIA is an open source Web Manager for Institutions. Versions 3.5.4 and below contain an SQL Injection vulnerability in the /html/matPat/editar_categoria.php endpoint. The application fails to properly validate and sanitize user inputs in the id_categoria parameter, allowing attackers to inject malicious SQL payloads. This issue is fixed in version 3.5.5.

WeGIA versions 3.5.4 and below contain a Stored Cross-Site Scripting (XSS) vulnerability in the /WeGIA/html/geral/configurar_senhas.php endpoint. The application does not sanitize user-controlled data before rendering it inside the employee selection dropdown, injecting employee names directly into HTML <option> elements without proper escaping.

WeGIA, an open source web manager for institutions, has a reflected XSS vulnerability in the editar_info_pessoal.php endpoint prior to version 3.5.1. Attackers can inject malicious scripts in the action parameter.

WeGIA, an open source Web Manager for Institutions, prior to version 3.5.1, contains a reflected cross-site scripting (XSS) vulnerability in the editar_info_pessoal.php endpoint. This vulnerability allows attackers to inject malicious scripts in the sql parameter. The vulnerable endpoint is GET /WeGIA/html/pessoa/editar_info_pessoal.php?sql=1. This issue has been patched in version 3.5.1.

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, an Open Redirect vulnerability was identified in the control.php endpoint, specifically in the nextPage parameter (metodo=listarTodos nomeClasse=AlmoxarifeControle). This vulnerability allows attackers to redirect users to arbitrary external domains, enabling phishing campaigns, malicious payload distribution, or user credential theft.

WeGIA, an open-source web manager for institutions, prior to version 3.5.1 contains a SQL Injection vulnerability in the /html/funcionario/dependente_documento.php endpoint, specifically in the id_dependente parameter. This allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. The vulnerability is fixed in 3.5.1.

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /pet/profile_pet.php?id_pet= endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_pet parameter. This vulnerability is fixed in 3.5.0.

WeGIA, an open source web manager for institutions, prior to version 3.5.1 has a Reflected Cross-Site Scripting (XSS) vulnerability in the log parameter in configuracao_geral.php. An attacker can inject arbitrary JavaScript, which executes in the victim's browser. This vulnerability is fixed in 3.5.1.

WeGIA prior to 3.5.1 has a SQL Injection vulnerability in the /html/funcionario/cadastro_funcionario_pessoa_existente.php endpoint, specifically in the cpf parameter. Attackers can execute arbitrary SQL commands, compromising confidentiality, integrity, and availability of the database.

WeGIA prior to version 3.5.1 has a Reflected Cross-Site Scripting (XSS) vulnerability in the /html/atendido/cadastro_atendido_parentesco_pessoa_nova.php endpoint, allowing attackers to inject malicious scripts in the idatendido parameter. This vulnerability is fixed in 3.5.1.

WeGIA prior to 3.5.1 has a SQL Injection vulnerability in the /html/funcionario/dependente_listar.php endpoint, specifically in the id_funcionario parameter. Attackers can execute arbitrary SQL commands, compromising confidentiality, integrity, and availability of the database.