CyberRota Analysis
AI-GeneratedThe vulnerability in WeGIA versions prior to 3.9.2 allows authenticated attackers to exploit an insecure direct object reference in the employee profile page, enabling unauthorized access to arbitrary employee records by manipulating the id_pessoa parameter. This could lead to the exposure of sensitive personal information, including names, CPF numbers, addresses, and contact details. Organizations using WeGIA should prioritize patching to mitigate the risk of data breaches and protect employee privacy.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an id_pessoa parameter through a request extraction function that overwrites the session-derived identifier. Attackers can enumerate all user identifiers to retrieve full profile data for any employee account, including name, CPF, address, contact details, and administrative flags.