Executive Summary

The vulnerability exists in WeGIA, a web manager for charitable institutions, in versions prior to 3.6.5. It involves the unsafe use of the PHP function extract() on the $_REQUEST superglobal. This unsafe use allows an unauthenticated attacker to overwrite local variables in multiple PHP scripts.

By exploiting this, an attacker can bypass authentication checks completely, gaining unauthorized access to administrative and protected areas of the WeGIA application.

The issue was fixed in version 3.6.5.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts as it allows an unauthenticated attacker to bypass authentication controls.

An attacker exploiting this flaw can gain unauthorized access to administrative and protected areas of the WeGIA application.

Such unauthorized access can lead to full compromise of the application, including potential data theft, data manipulation, or disruption of services.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade the WeGIA application to version 3.6.5 or later, as this version fixes the unsafe use of the extract() function on the $_REQUEST superglobal that allows unauthenticated attackers to bypass authentication.

Useful 0 Not Useful 0