WeGIA SQL Injection Vulnerability in adicionar_especie.php Endpoint

A SQL injection vulnerability has been identified in the WeGIA application, specifically within the adicionar_especie.php endpoint. This flaw allows attackers to execute arbitrary SQL commands, leading to unauthorized access to sensitive information. Exploitation of this vulnerability enabled a complete dump of the application's database, underscoring its severity. The issue arises because the application fails to properly validate or sanitize the 'especie' parameter, allowing direct manipulation of SQL queries. This vulnerability affects WeGIA versions prior to 3.2.9 and has been patched in version 3.2.10.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive data, such as personal information and credentials, which can be used to compromise user accounts. The vulnerability also enables data exfiltration by dumping entire database tables, causing potential reputational damage and allowing for chain attacks using the obtained information.

Reproduction

The vulnerability can be reproduced by sending a POST request to the adicionar_especie.php endpoint with a crafted 'especie' parameter that includes malicious SQL code. This can be automated using a tool like SQLMap, which can exploit the injection and dump the database.

Remediation

Users are advised to update to WeGIA version 3.2.10, where this vulnerability has been fixed.