Listen to this Post
How the CVE Works
The vulnerability in WeGIA (prior to v3.4.5) lies in the `/dao/verificar_recursos_cargo.php` endpoint, which fails to validate user sessions or authentication tokens. Attackers can craft HTTP requests (e.g., GET/POST) to this endpoint without credentials, bypassing authentication and accessing restricted functionalities. This flaw exposes sensitive data, such as internal resources or user permissions, due to inadequate server-side checks. The issue is fixed in v3.4.5 by enforcing session validation.
DailyCVE Form
Platform: WeGIA
Version: <3.4.5
Vulnerability: Auth Bypass
Severity: Medium
Date: 07/16/2025
Prediction: Patch by 08/2025
What Undercode Say
Analytics:
curl -X POST http://<target>/dao/verificar_recursos_cargo.php -d "param=exploit"
SELECT FROM recursos_cargo WHERE id=1; -- Unauthorized access
Exploit:
Craft unauthenticated HTTP requests to the vulnerable endpoint to leak data.
Protection from this CVE:
Upgrade to WeGIA v3.4.5+.
Impact:
Unauthenticated data exposure.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
