WeGIA vulnerabilities

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identified in the get_relatorios_socios.php endpoint. This vulnerability allows unauthenticated attackers to directly access sensitive personal and financial information of members without requiring authentication or authorization. This issue is fixed in version 3.5.0.

WeGIA, an open-source web manager for charitable institutions, versions 3.4.12 and below contain an Open Redirect vulnerability in the control.php endpoint, specifically in the nextPage parameter (metodo=listarUmnomeClasse=FuncionarioControle). This allows attackers to redirect users to arbitrary external domains, enabling phishing campaigns, malicious payload distribution, or credential theft. The issue is fixed in version 3.5.0.

WeGIA, an open-source web manager for charitable institutions, versions 3.4.12 and below have a CSRF vulnerability. The delete operation for the Almoxarifado entity is exposed via HTTP GET without CSRF protection, allowing a third-party site to trigger the action using the victim's authenticated session. Fixed in version 3.5.0.

WeGIA, a web manager for charitable institutions, prior to version 3.5.0 is vulnerable to SQL Injection attacks in the control.php endpoint with the following parameters: nomeClasse=ProdutoControle&metodo=excluir&id_produto=[malicious command]. It is necessary to apply prepared statements methods, sanitization, and validations on the id_produto parameter. This issue has been patched in version 3.5.0.