CVE-2025-53937 is a Critical severity SQL injection (CVSS 9.8) in WeGIA, the open source web manager used by charitable institutions. The cargo parameter of the /controle/control.php endpoint is injectable. Version 3.4.5 fixes the issue, so upgrade to it or later.
What's affected
The advisory says WeGIA versions before 3.4.5 are affected. Version 3.4.5 is the fixed release.
The weak input is the cargo parameter of the /controle/control.php endpoint. The advisory title describes it as a blind, time based SQL injection, which means the page may not show database errors, but the database can still be made to respond differently.
WeGIA is built for charities and similar institutions, and it holds records about people. That gives any database flaw a human cost beyond the usual technical one.
How to check if you're exposed
Look at the version of your WeGIA installation in the application or in the release you deployed. If you track the source, check the tag:
git describe --tags
grep -rn "cargo" controle/control.php
Anything before 3.4.5 is affected. Then check the access log for repeated requests to /controle/control.php with the cargo parameter and an unusually long response time, since a time based technique leaves a pattern of slow requests from one address.
What to do now
- Upgrade WeGIA to 3.4.5 or later.
- Limit access to the WeGIA address to your staff network or a VPN until the upgrade is verified.
- Review the database account WeGIA uses and remove rights it does not need.
- Check the access and database logs for slow, repetitive requests to control.php, and keep copies if you find any.
- If you see signs of misuse, treat records about people as exposed and follow your data protection duties.
Why it matters
The weakness is CWE-89, SQL injection. A value from the web request is joined into a database query, so the database cannot tell data from instructions. In a blind, time based case the attacker learns what they need by asking the database yes or no questions and watching how long the answer takes.
The repair is to use prepared statements with bound parameters, and to check that cargo only holds expected values. Applications that grew over many years often have the same pattern in several places, so a good review looks at every endpoint and not only the one reported.
The record is not in the CISA Known Exploited Vulnerabilities catalogue. The advisory does not claim attacks.
Quick check
What does blind time based mean?
The page does not show database output or errors. The attacker infers data from how long the server takes to answer, which is slower but works against pages that hide errors.
Is 3.4.4 affected?
Yes. The advisory names versions before 3.4.5 as affected, so 3.4.4 and older need the upgrade.
Sources
Last reviewed: 18 October 2026.
