CVE-2025-62179

Executive Summary

CVE-2025-62179 is a critical SQL Injection vulnerability in WeGIA, an open-source web manager for institutions, primarily used by Portuguese-speaking users. The flaw resides in the /html/funcionario/cadastro_funcionario_pessoa_existente.php endpoint, specifically within the cpf parameter. An unauthenticated attacker can inject arbitrary SQL commands, leading to full compromise of the database's confidentiality, integrity, and availability. The vulnerability affects all versions prior to 3.5.1. No public exploit code or Nuclei template is available at this time, but the vulnerability is considered high risk due to the lack of authentication required and the sensitive nature of the data typically managed by WeGIA.

Supply Chain & Package Security

WeGIA is a PHP-based application. The vulnerability is introduced in the application's own codebase, not in a third-party package. However, organizations using WeGIA should verify the integrity of their installation and ensure they are not running modified or outdated versions from untrusted sources. The patch is available in the official WeGIA repository.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability can be exploited remotely without authentication, allowing an attacker to exfiltrate, modify, or delete the entire database.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the cpf parameter of the cadastro_funcionario_pessoa_existente.php script. The application likely constructs a SQL query by directly concatenating user input without proper sanitization or parameterized queries. The cpf (Brazilian individual taxpayer registry) parameter is used to look up existing employees. An attacker can inject SQL metacharacters (e.g., a single quote ') to break out of the intended query structure and execute arbitrary SQL statements.

The injection point is in a SELECT or UPDATE statement that checks if a person with the given CPF already exists. By manipulating the input, an attacker can:

• Bypass authentication or authorization checks.
• Extract sensitive data from other tables (e.g., user credentials, personal data).
• Insert malicious data.
• Perform denial of service by dropping tables or corrupting data.

The vulnerability is fixed in version 3.5.1 by implementing proper input validation and using prepared statements or parameterized queries.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-3.5.1):

// /html/funcionario/cadastro_funcionario_pessoa_existente.php
$cpf = $_GET['cpf'];
$query = "SELECT * FROM pessoas WHERE cpf = '$cpf'";
$result = mysqli_query($conn, $query);

Patched Code (3.5.1):

// /html/funcionario/cadastro_funcionario_pessoa_existente.php
$cpf = mysqli_real_escape_string($conn, $_GET['cpf']);
$query = "SELECT * FROM pessoas WHERE cpf = '$cpf'";
$result = mysqli_query($conn, $query);

Or, preferably, using prepared statements:

$stmt = $conn->prepare("SELECT * FROM pessoas WHERE cpf = ?");
$stmt->bind_param("s", $cpf);
$stmt->execute();

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable WeGIA instance (version < 3.5.1) using Docker or a local LAMP stack.
2. Ensure the application is accessible over the network.

Exploitation Steps:

1. Identify the vulnerable endpoint: /html/funcionario/cadastro_funcionario_pessoa_existente.php?cpf=
2. Test for SQL injection by sending a single quote: cpf='
   • Expected response: SQL error or unexpected behavior.
3. Use a simple UNION-based injection to extract data:

   cpf=' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -
   

   Adjust the number of columns based on the original query.
4. Extract database version:

   cpf=' UNION SELECT @@version,2,3,4,5,6,7,8,9,10-- -
   

5. Dump user credentials from the usuarios table:

   cpf=' UNION SELECT usuario, senha, 3,4,5,6,7,8,9,10 FROM usuarios-- -
   

Example Payload:

' OR '1'='1' -- -

Blue Team

Detection Steps:

1. Monitor web server logs for requests to /html/funcionario/cadastro_funcionario_pessoa_existente.php with unusual cpf parameters.
2. Look for patterns such as single quotes, UNION, SELECT, OR, --, or other SQL metacharacters in the cpf parameter.
3. Enable database query logging to detect anomalous SQL statements.
4. Use a Web Application Firewall (WAF) to block SQL injection patterns.

Hunting Queries:

• Search for cpf= followed by SQL keywords in access logs.
• Alert on any cpf parameter containing ', ", ;, --, #, or /*.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /html/funcionario/cadastro_funcionario_pessoa_existente.php with cpf parameter containing SQL metacharacters.
  • Outbound database connections from the web server to unexpected IPs (data exfiltration).
• File IOCs:
  • Modified or new files in the WeGIA installation directory (e.g., webshells).
  • Suspicious entries in database logs.
• System IOCs:
  • Unusual database queries (e.g., UNION SELECT, xp_cmdshell if MSSQL).
  • High CPU or memory usage on the database server.

Detection Engineering

YARA Rule

rule CVE_2025_62179_SQLi_WeGIA {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-62179 in WeGIA"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-62179"
    strings:
        $s1 = "cadastro_funcionario_pessoa_existente.php" nocase
        $s2 = "cpf=" nocase
        $sqli1 = /cpf=.*['\"]/ nocase
        $sqli2 = /cpf=.*UNION/i
        $sqli3 = /cpf=.*SELECT/i
        $sqli4 = /cpf=.*OR/i
        $sqli5 = /cpf=.*--/i
    condition:
        $s1 and $s2 and ($sqli1 or $sqli2 or $sqli3 or $sqli4 or $sqli5)
}

Sigma Rule

title: SQL Injection Attempt Against WeGIA CVE-2025-62179
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting the cpf parameter in WeGIA
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "cadastro_funcionario_pessoa_existente.php?cpf="
        cs-uri-query|re: 
            - "cpf=.*['\"]"
            - "cpf=.*UNION"
            - "cpf=.*SELECT"
            - "cpf=.*OR"
            - "cpf=.*--"
    condition: selection
falsepositives:
    - Legitimate CPF numbers containing special characters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-62179 WeGIA SQL Injection Attempt";
    flow:to_server,established;
    content:"cadastro_funcionario_pessoa_existente.php";
    http_uri;
    content:"cpf=";
    http_uri;
    pcre:"/cpf=.*['\"]|cpf=.*UNION|cpf=.*SELECT|cpf=.*OR|cpf=.*--/i";
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade WeGIA to version 3.5.1 or later.
2. If immediate upgrade is not possible, apply a virtual patch using a WAF to block SQL injection patterns in the cpf parameter.
3. Restrict network access to the WeGIA web interface to trusted IPs only.

Long-term Measures:

1. Conduct a code review to ensure all database queries use parameterized statements or prepared statements.
2. Implement input validation for all user-supplied data.
3. Regularly update WeGIA and all dependencies.
4. Enable detailed logging and monitoring for web and database servers.

Valters IT - Securing your digital infrastructure.