CVE-2025-52474 is a high-severity SQL Injection vulnerability affecting versions of the WeGIA web management software prior to 3.4.2. WeGIA is a web-based management platform designed for charitable institutions, developed by LabRedesCefetRJ. The vulnerability exists specifically in the 'id' parameter of the /WeGIA/controle/control.php endpoint. Due to improper neutralization of special elements in SQL commands (CWE-89), an attacker can manipulate the SQL query executed by the backend database. This manipulation allows unauthorized access to sensitive database information, including table names and potentially confidential data stored within the database. The vulnerability does not require user interaction or authentication, making it remotely exploitable over the network with low attack complexity. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) indicates that the attack can be launched remotely without user interaction, requires low privileges (likely a low-privileged authenticated user), and has a high impact on confidentiality and system security. The vulnerability has been patched in WeGIA version 3.4.2, and no known exploits are currently reported in the wild. However, the presence of such a vulnerability in software used by charitable institutions poses a significant risk of data leakage and unauthorized data manipulation if left unpatched.

For European organizations, particularly charitable institutions or NGOs using WeGIA or similar web management platforms, this vulnerability could lead to significant data breaches. Sensitive information such as donor details, financial records, and internal organizational data could be exposed or manipulated. This could result in reputational damage, loss of donor trust, and potential regulatory penalties under GDPR due to unauthorized access to personal data. Additionally, attackers could leverage the vulnerability to gain further foothold within the organization's IT infrastructure, potentially leading to broader compromise. The impact on availability is limited, but the high confidentiality impact and the ease of exploitation make this a critical concern for organizations handling sensitive data. Given the nature of the affected software, the threat is particularly relevant to smaller and medium-sized charitable organizations that may lack robust cybersecurity defenses.

1. Immediate upgrade to WeGIA version 3.4.2 or later to apply the official patch addressing the SQL Injection vulnerability. 2. Conduct a thorough audit of all web-facing endpoints, especially those handling user-supplied input, to ensure proper input validation and parameterized queries are implemented. 3. Implement Web Application Firewalls (WAFs) with custom rules to detect and block SQL Injection attempts targeting the 'id' parameter and similar inputs. 4. Restrict database user privileges used by the WeGIA application to the minimum necessary, preventing unauthorized data access or modification beyond what is required for normal operations. 5. Monitor application logs and database query logs for unusual or suspicious activity indicative of SQL Injection attempts. 6. Educate IT staff and administrators of charitable institutions on the importance of timely patching and secure coding practices. 7. If upgrading immediately is not feasible, consider temporary mitigations such as input filtering or disabling vulnerable endpoints until a patch can be applied.