CVE-2025-53527 is a critical time based blind SQL injection flaw (CVSS 9.8) in WeGIA, the web manager for charitable institutions. It affects the report generation endpoint in version 3.3.3. Version 3.4.1 fixes it, so upgrade and check your database and web logs for access you cannot explain.
What's affected
The GitHub advisory GHSA-43xw-c4g6-jgff lists the Composer package WeGIA, affected version 3.3.3, and patched version 3.4.1. The advisory rates it High, and the NVD record scores it 9.8 Critical. The weakness is CWE-89.
The endpoint is /controle/relatorio_geracao.php. The record names the almox parameter, while the body of the advisory discusses the tipo and responsavel parameters. Because the descriptions differ, treat the whole endpoint as affected and rely on the upgrade, not on parameter level filters.
The advisory says the issue is blind and was confirmed by timing, and that no authentication is needed. A fix commit is linked from the record.
How to check if you're exposed
Find the WeGIA version. If you installed from a Git checkout, this shows the tag:
git describe --tags
Anything before 3.4.1 should be treated as affected, including 3.4.0, since the sibling issue CVE-2025-53091 was fixed in 3.4.0 and this one a release later.
Check web server access logs for requests to the report generation endpoint with unusual parameter values or very slow responses. Time based attacks leave long response times in the logs, which makes them visible to anyone who looks.
What to do now
- Upgrade WeGIA to 3.4.1 or later. This covers CVE-2025-53091 too.
- Back up the database and files first, and test your customisations afterwards.
- Limit access to the application with a VPN or an allow list where possible.
- Review logs for abnormal requests to the report endpoint and for slow responses.
- Rotate administrator and database credentials if you see signs of misuse.
Why it matters
The advisory describes untrusted input reaching the database as part of a query. In a time based blind injection the attacker cannot see query results but can make the database pause, and the response time then reveals one bit of information per request. Automated tools do this at scale.
Unauthenticated access makes it more serious. WeGIA is used by charities, which hold personal data on beneficiaries and donors. The CVE is not on the CISA Known Exploited Vulnerabilities list and the record gives no sign of attacks. Prepared statements with bound parameters are the durable fix, and upgrading brings the maintainers' changes.
Quick check
Is 3.4.0 enough?
No. The advisory for this CVE lists 3.4.1 as the patched version. Use 3.4.1 or later.
Sources
Last reviewed: 18 October 2026.
