CVE-2025-46828
Unauthenticated SQL Injection on get_socios.php endpoint
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Unauthenticated SQL Injection on get_socios.php endpoint
WeGIA is a web manager for charitable institutions. An unauthenticated SQL Injection vulnerability was identified in versions up to and including 3.3.0 in the endpoint `/html/socio/sistema/get_socios.php`, specifically in the query parameter. This issue allows attackers to inject and execute arbitrary SQL statements against the application's underlying database. As a result, it may lead to data exfiltration, authentication bypass, or complete database compromise. Version 3.3.1 fixes the issue.
Reserved 2025-04-30 | Published 2025-05-07 | Updated 2025-05-07 | Assigner GitHub_MCWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
github.com/.../WeGIA/security/advisories/GHSA-5qw5-q55h-6qg7
github.com/...ommit/214dab59509bd3637f94adf381298c12da4ff80f
Support options
