CVE-2025-24905: Critical SQL Injection in WeGIA Billing Barcode

CVE-2025-24905 is a critical SQL injection (CVSS 9.8) in WeGIA, a web manager for charitable institutions, in the get_codigobarras_cobranca.php endpoint. It is fixed in WeGIA 3.2.12 and has no workaround. Upgrade, and keep the application away from untrusted networks until you have.

What's affected

The NVD record names WeGIA, a web manager for charitable institutions, and says the problem is addressed in version 3.2.12 with all users advised to upgrade. Versions before 3.2.12 are the range to treat as affected. There are no known workarounds.

The weak spot is the get_codigobarras_cobranca.php endpoint. The advisory shows the codigo request parameter flowing into a query on the billing records table without validation. The record words it as an authorized attacker, but the score of 9.8 and a vector with no privileges required point to reach without a login, and the advisory says unauthorized users can exploit it. Read the advisory for your version and assume the stricter reading.

The record is not on the CISA Known Exploited Vulnerabilities list.

The weakness is classed as CWE-89 (SQL injection). The score is 9.8 (CRITICAL). The vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reads as reachable over the network, low attack complexity, no privileges required and no user interaction. Impact is high on confidentiality, high on integrity and high on availability. The record was published on 2025-02-03.

WeGIA 3.2.12 is the fixed version named in the record. The advisory says there are no known workarounds, so the upgrade is the fix. Move to 3.2.12 or a later release.

How to check if you're exposed

WeGIA is a self-hosted PHP application, so check each installation you run.

1. Sign in and read the version shown in the interface, or read it from the release you deployed.
2. If it is below 3.2.12, you are affected.
3. Search your web root for the endpoint named in the record to confirm the vulnerable file is present.

find /var/www -name "get_codigobarras_cobranca.php" 2>/dev/null

4. Check whether the application is reachable from the internet, and whether the endpoint can be called without signing in.
5. Search access logs for requests to the endpoint with quote characters or SQL keywords in its parameters.

grep "get_codigobarras_cobranca.php" /var/log/apache2/access.log | grep -iE "union|select|sleep|%27"

A match is a lead to investigate, not proof of compromise.

What to do now

1. Back up the database and files, then upgrade WeGIA to 3.2.12 or later.
2. Until you have upgraded, restrict access to the application to trusted networks, or take it offline if it is not in use.
3. Review logs for requests to the affected endpoint from addresses you do not recognise.
4. If exposure is possible, review the database for unexpected changes and rotate credentials stored in it.
5. Check that the application's database account has only the rights it needs.

Why it matters

SQL injection, listed as CWE-89, happens when input is built into a query as text, so the database cannot tell data from instruction. The advisory for this issue shows the pattern at the level of the code: a request value used directly in a query with no validation. The fix is to bind the value as a parameter.

WeGIA is used by charitable institutions, which often hold donor, member and billing details and run with small IT teams. A flaw that allows reading or deleting records is serious for them, and a score of 9.8 reflects high impact on all three of confidentiality, integrity and availability. It is part of a group of similar findings, so after you patch, review the rest of the application's queries as well.

If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Safeguard Gold entry for CVE-2025-24905
• NVD record data for CVE-2025-24905 (published 2025-02-03)
• WeGIA security advisory GHSA-qjc6-5qv6-fr8m

Last reviewed: 19 October 2026.