Executive brief
WeGIA, a web-based management platform for charitable institutions, was found to store user passwords using an insecure method. Because the system uses a fast hashing algorithm without a unique 'salt' for each user, an attacker who gains access to the database can easily reverse these hashes to discover the original plaintext passwords. This could lead to unauthorized access to sensitive institutional data and administrative accounts.
Technical details
WeGIA versions prior to 3.7.3 utilize the PHP hash() function with the SHA-256 algorithm and no salt for both login verification (html/login.php) and password updates (controle/FuncionarioControle.php). SHA-256 is a general-purpose hash designed for speed, making it unsuitable for password storage as it lacks computational cost. The absence of a salt ensures that identical passwords result in identical hashes, facilitating the use of precomputed rainbow tables. If an attacker extracts the 'pessoa' table (e.g., via SQL injection as demonstrated in the PoC), they can perform high-speed offline brute-force attacks to recover plaintext credentials. This issue is resolved in version 3.7.3.
Affected products
- LabRedesCefetRJ WeGIA < 3.7.3
Timeline
- 2026-05-06: advisory: GitHub security advisory published by developer
- 2026-05-27: disclosed: CVE published to NVD dataset