WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only …
Critical CVSS 9.1
Summary
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only against a hardcoded chave_correta value embedded in the public source repository. A remote attacker who obtains that value can reach the endpoint's TRUNCATE TABLE operations for the endereco, pessoafisica, pessoajuridica, and socio tables without an administrative session or application authorizatio…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/LabRedesCefetRJ/WeGIA/commit/84d9d0a7c66c29b238ab381ffcfb9e0ce260796a
- https://github.com/LabRedesCefetRJ/WeGIA/pull/1689
- https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.5
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-399w-rxhp-jh9f
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-399w-rxhp-jh9f
Timeline
- nvd_ingest NVD