WeGIA vulnerabilities

WeGIA is a web manager for charitable institutions. Prior to version 3.6.2, an authenticated SQL Injection vulnerability was identified in the Atendido_ocorrenciaControle endpoint via the id_memorando parameter. This flaw allows for full database exfiltration, exposure of sensitive PII, and potential arbitrary file reads in misconfigured environments. This vulnerability is fixed in 3.6.2.

In WeGIA (a web manager for charitable institutions) prior to 3.8.5, the deletar_socios.php endpoint is accessible without authentication, and its chave parameter is checked only against a hardcoded value embedded in the public repository. An attacker who knows that value can trigger TRUNCATE TABLE operations on the endereco, pessoafisica, pessoajuridica, and socio tables, permanently destroying member and contributor records.

In WeGIA prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive ContribuicaoLogController operations from authentication, and constructs a controller include path without canonical directory containment. An unauthenticated attacker can invoke sensitive methods, disclose contribution and donation records, trigger financial operations, and include files outside the intended controller directory.

WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the WeGIA system, specifically within the html/memorando/insere_despacho.php file. The application fails to properly sanitize or encode user-supplied input via the id_memorando GET parameter before reflecting it into the HTML source (likely inside a <script> block or an attribute). This allows unauthenticated attackers to inject arbitrary JavaScript or HTML into the context of the user's browser session. This vulnerability is fixed in 3.6.2.

WeGIA versions 3.4.12 and below contain an SQL Injection vulnerability in the /pet/profile_pet.php endpoint, specifically in the id_pet parameter, allowing attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue is fixed in version 3.5.0.

WeGIA versions 3.4.12 and below include an SQL Injection vulnerability in the /controle/control.php endpoint, specifically in the descricao parameter, allowing attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue is fixed in version 3.5.0.

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in web/controle/InternoControle.php, including listarUm, alterar, and excluir, accept user-controlled id or idInterno values without verifying ownership, allowing a low-privileged user to read, modify, or delete another person's records and expose personal, identity, address, medical, and family information. The advisory notes that a self-referencing load bug can crash this controller in the reported revision, but the empty-resource authorization pattern and affected methods remain the vulnerability under review. This issue is fixed in version 3.8.5.

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an id_pessoa parameter through a request extraction function that overwrites the session-derived identifier. Attackers can enumerate all user identifiers to retrieve full profile data for any employee account, including name, CPF, address, contact details, and administrative flags.

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover.

WeGIA prior to version 3.6.9 contains an open redirect vulnerability. The 'redirect' parameter taken from the GET request is not validated or whitelisted, then used directly in a Location header. An attacker can redirect users to a malicious site.

WeGIA before version 3.6.9 contains an open redirect vulnerability. The 'redirect' parameter is taken directly from $_GET without URL validation and used in a Location header, allowing redirection to arbitrary external sites.

WeGIA before version 3.6.9 has an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the 'nextPage' parameter. The application fails to validate this parameter, allowing attackers to redirect users to arbitrary external sites.

WeGIA before version 3.6.9 contains an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter when combined with metodo=listarTodos and nomeClasse=EstoqueControle. The parameter is not validated, allowing redirection to arbitrary external websites.

WeGIA before 3.6.9 has a stored XSS vulnerability via a backup filename. An attacker can inject malicious scripts that execute in the victim's browser.

WeGIA prior to 3.6.9 has an Open Redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter. The application fails to validate the parameter, allowing redirection to arbitrary external sites.

WeGIA before version 3.6.9 contains an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter when combined with metodo=listarId and nomeClasse=IsaidaControle. The parameter is not validated, allowing redirection to arbitrary external websites.

WeGIA (Web manager for charitable institutions) versions prior to 3.6.9 contain a SQL injection vulnerability in dao/memorando/DespachoDAO.php. The id_memorando parameter is extracted from $_REQUEST without validation and directly interpolated into SQL queries, allowing any authenticated user to execute arbitrary SQL commands against the database. This vulnerability is fixed in version 3.6.9.

WeGIA, an open source web manager for institutions, has a reflected XSS vulnerability in the editar_info_pessoal.php endpoint prior to version 3.5.1. Attackers can inject malicious scripts in the action parameter.

WeGIA, an open source Web Manager for Institutions, prior to version 3.5.1, contains a reflected cross-site scripting (XSS) vulnerability in the editar_info_pessoal.php endpoint. This vulnerability allows attackers to inject malicious scripts in the sql parameter. The vulnerable endpoint is GET /WeGIA/html/pessoa/editar_info_pessoal.php?sql=1. This issue has been patched in version 3.5.1.

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, an Open Redirect vulnerability was identified in the control.php endpoint, specifically in the nextPage parameter (metodo=listarTodos nomeClasse=AlmoxarifeControle). This vulnerability allows attackers to redirect users to arbitrary external domains, enabling phishing campaigns, malicious payload distribution, or user credential theft.

WeGIA, an open-source web manager for institutions, prior to version 3.5.1 contains a SQL Injection vulnerability in the /html/funcionario/dependente_documento.php endpoint, specifically in the id_dependente parameter. This allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. The vulnerability is fixed in 3.5.1.

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /pet/profile_pet.php?id_pet= endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_pet parameter. This vulnerability is fixed in 3.5.0.

WeGIA, an open source web manager for institutions, prior to version 3.5.1 has a Reflected Cross-Site Scripting (XSS) vulnerability in the log parameter in configuracao_geral.php. An attacker can inject arbitrary JavaScript, which executes in the victim's browser. This vulnerability is fixed in 3.5.1.

WeGIA prior to 3.5.1 has a SQL Injection vulnerability in the /html/funcionario/cadastro_funcionario_pessoa_existente.php endpoint, specifically in the cpf parameter. Attackers can execute arbitrary SQL commands, compromising confidentiality, integrity, and availability of the database.

WeGIA prior to version 3.5.1 has a Reflected Cross-Site Scripting (XSS) vulnerability in the /html/atendido/cadastro_atendido_parentesco_pessoa_nova.php endpoint, allowing attackers to inject malicious scripts in the idatendido parameter. This vulnerability is fixed in 3.5.1.

WeGIA prior to 3.5.1 has a SQL Injection vulnerability in the /html/funcionario/dependente_listar.php endpoint, specifically in the id_funcionario parameter. Attackers can execute arbitrary SQL commands, compromising confidentiality, integrity, and availability of the database.

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identified in the get_relatorios_socios.php endpoint. This vulnerability allows unauthenticated attackers to directly access sensitive personal and financial information of members without requiring authentication or authorization. This issue is fixed in version 3.5.0.

WeGIA, an open-source web manager for charitable institutions, versions 3.4.12 and below contain an Open Redirect vulnerability in the control.php endpoint, specifically in the nextPage parameter (metodo=listarUmnomeClasse=FuncionarioControle). This allows attackers to redirect users to arbitrary external domains, enabling phishing campaigns, malicious payload distribution, or credential theft. The issue is fixed in version 3.5.0.

WeGIA, an open-source web manager for charitable institutions, versions 3.4.12 and below have a CSRF vulnerability. The delete operation for the Almoxarifado entity is exposed via HTTP GET without CSRF protection, allowing a third-party site to trigger the action using the victim's authenticated session. Fixed in version 3.5.0.

WeGIA, a web manager for charitable institutions, prior to version 3.5.0 is vulnerable to SQL Injection attacks in the control.php endpoint with the following parameters: nomeClasse=ProdutoControle&metodo=excluir&id_produto=[malicious command]. It is necessary to apply prepared statements methods, sanitization, and validations on the id_produto parameter. This issue has been patched in version 3.5.0.