CVE-2025-30367 is a critical (CVSS 9.8) SQL injection in WeGIA, a web manager for charitable institutions. Before version 3.2.6, the nextPage parameter of /WeGIA/controle/control.php let an attacker manipulate SQL queries. Version 3.2.6 fixes it, though two later SQL injection issues need 3.2.8, so upgrade to the latest release.
What's affected
The record and the GitHub advisory list WeGIA versions before 3.2.6 as affected. WeGIA is a web manager for charitable institutions, and it is installed through Composer according to the advisory.
Version 3.2.6 contains the fix.
The record does not flag the CVE as known exploited, and the CVE is not in the CISA KEV catalog at the time of writing.
How to check if you're exposed
Find the version of WeGIA you run.
- Check the version shown in the application, or the release or tag you deployed from.
- For Composer based installs, run composer show on the package to see the version.
- Search your web server access logs for requests to the affected path and unusual parameter values, and check database logs for errors.
If you manage donor or beneficiary data in WeGIA, assume that the database is a target and check backups.
What to do now
- Upgrade WeGIA to 3.2.6 or later, ideally the latest release because other fixes came after.
- Review logs for requests to control.php with unusual nextPage values.
- Limit database permissions for the application account.
- Restrict the application to trusted networks if possible.
- Check that you also have the fix for CVE-2025-30364 and CVE-2025-30365, which need 3.2.8.
Why it matters
The record maps the flaw to CWE-89 (SQL Injection). The nextPage parameter is meant to say where to go after an action, but it ends up inside a database query. The advisory says this allows manipulation of queries to read database details such as table names and sensitive data.
The control.php file is a central controller, so it is reachable from many workflows. That makes any flaw in it widely reachable. Because the fix for the two later SQL injection CVEs landed in 3.2.8, staying on 3.2.6 is not enough.
Parameters that look like navigation hints are easy to overlook in a review. Treat every request value as untrusted, even those that appear to be internal.
If you run WeGIA, also confirm that backups are recent and kept away from the application server. A restore test is worth doing while you are upgrading. Injection flaws can alter data as well as read it, and a clean backup is the fastest way back.
Quick check
Is 3.2.6 enough?
It fixes this CVE. Two other WeGIA SQL injection CVEs need 3.2.8, so upgrade to the latest version.
What can an attacker read?
The advisory mentions table names and sensitive database information.
Sources
Last reviewed: 19 October 2026.
