CVE-2025-22133 - CVE House

Back to Database

Status published Critical CVE-2025-22133

WeGIA Allows Arbitrary File Upload with Remote Code Execution (RCE)

10 CVSS

Vulnerability Description

WeGIA is a web manager for charitable institutions. Prior to 3.2.8, a critical vulnerability was identified in the /WeGIA/html/socio/sistema/controller/controla_xlsx.php endpoint. The endpoint accepts file uploads without proper validation, allowing the upload of malicious files, such as .phar, which can then be executed by the server. This vulnerability is fixed in 3.2.8.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-22133

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from nilsonLazarin

View All →

WeGIA SQL Injection (Blind Time-Based) endpoint 'verificar_recursos_cargo.php' parameter 'cargo'

WeGIA SQL Injection (Blind Time-Based) endpoint 'dependente_listar_um.php' parameter 'id_dependente'

WeGIA Cross-Site Scripting (XSS) Reflected endpoint `configuracao_geral.php` parameter `msg`

WeGIA has a Cross-Site Scripting (XSS) in File Upload Field

Affected Vendor

nilsonLazarin

View all reports →

Affected Software

WeGIA

Vulnerable Versions:

< 3.2.8

Timeline

Official Publish: January 7th, 2025

Last Modified: January 8th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1565.002 Stored Data Manipulation