Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

LabRedesCefetRJ/WeGIA

              master @ ee1587b
            

347

Fixes

CVEs

CRITICAL

Peak severity

18.2%

Coverage

Highlights

SQL Injection: 91 prior fixes. Scrutinize any change in this area.

controle/FuncionarioControle.php: most-fixed (13 issues). Treat as high-risk during review.

170 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: The application dynamically concatenated request parameters directly into database queries and relied on unsafe global variable extraction (extract), leading to critical SQL injection vectors that allow full database compromise. This was historically addressed by routing queries safely through controllers.

Remote Code Execution: Unescaped system argument concatenation in backup management and branch-switching utility endpoints allowed unauthenticated or administrative command execution through shell wrapper interfaces. Mitigated by switching to strict argument escaping and parameterized execution APIs.

Auth Bypass: The use of extract() on client-provided parameters permitted attackers to overwrite critical local authorization variables, bypassing login mechanics entirely. Restricting parameter extraction and enforcing strict initialization was required to secure the authentication flow.