CVE-2025-23220 is a critical (CVSS 9.8) SQL injection flaw in WeGIA, an open source web manager for charitable institutions, in the adicionar_raca.php endpoint. The advisory lists versions before 3.2.9 as affected and 3.2.10 as patched. Upgrade to 3.2.10 or later.
What's affected
The GitHub advisory GHSA-425j-h4cf-g52j covers the Composer package WeGIA. It lists affected versions before 3.2.9 and the patched version as 3.2.10. The NVD description says the issue is fixed in 3.2.10, so use that as your target and confirm in the release notes.
The weak spot is the adicionar_raca.php endpoint, which handles the raca parameter in a POST request. The advisory says the application does not validate or sanitize this input. The vector is AV:N/AC:L/PR:N/UI:N, so the NVD scoring treats it as reachable over the network without an account. The advisory states that testing confirmed a complete dump of the application's database was possible.
WeGIA has several sibling advisories of the same type, one for each of a few pet record endpoints. Upgrading once fixes the lot, but check each CVE's endpoint against your version.
How to check if you're exposed
WeGIA is distributed through Composer and as an application you deploy yourself. Check the version you run:
composer show | grep -i wegia
grep -ri "version" composer.json
If you installed from a release archive, compare the release number with 3.2.10. Then check where the app is reachable. Charities and small institutions often expose such systems to the internet for staff and volunteers. Look at web server logs for POST requests to adicionar_raca.php from addresses you do not recognize.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Upgrade WeGIA to 3.2.10 or later.
- Take a database backup before upgrading.
- Check web logs for unexpected requests to the adicionar_raca.php endpoint and for odd database errors.
- Run the application's database account with the minimum privileges it needs. It should not own the schema or reach other databases.
- If the app was exposed while unpatched, treat stored credentials as exposed: force password resets and review user accounts.
- Put the application behind a VPN or an allowlist if internet access is not required.
Why it matters
CWE-89 is SQL injection. The code builds a database query by inserting the raca value into a string, so special characters in the input can change what the query does. The usual fix is to use prepared statements with bound parameters, so input is always treated as data.
The data at stake here is personal. The advisory's own impact list includes access to credentials, personal or financial data, and exfiltration of whole tables. For an organization that holds records on people it serves, that is a serious privacy matter. The KEV flag for this CVE is false and the record does not claim exploitation.
Quick check
Which release fixes it?
WeGIA 3.2.10. The advisory lists versions before 3.2.9 as affected.
Is a login required?
The NVD vector shows no privileges required. The advisory's own steps used a session cookie, so check the advisory text for how your deployment is reached.
Sources
Last reviewed: 19 October 2026.
