CVE-2025-58745·PHP vulnerability

Affected versions

How to fix this CVE

Upgrade PHP and the WeGIA application to version 3.4.11 or later to address a critical file upload vulnerability that allows attackers to bypass MIME type validation by injecting Excel magic bytes into PHP files. This vulnerability enables remote code execution on affected servers and must be patched immediately. After upgrading, verify that file upload endpoints properly validate file content rather than relying solely on MIME type headers.

sudo dnf update php php-common php-cli php-fpm

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST /html/socio/sistema/controller/controla_xlsx.php with file upload containing magic bytes PK\x03\x04 (ZIP/Excel signature) followed by PHP code; look for requests from authenticated users with suspicious filenames like *.php.xlsx or files with double extensions

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement content-based file validation rules that inspect file headers and magic bytes, not just MIME types; block uploads to /html/socio/sistema/controller/ endpoints that contain PHP executable code; enforce strict file type whitelisting for Excel imports and reject any multi-part uploads containing PHP MIME types

How to check if you are affected

1. Run `php -v` to confirm the installed PHP version and check if it is below the patched version
2. Verify the WeGIA application version by checking the version file or admin panel (typically found in /html/socio/sistema/ or documented in README/CHANGELOG)
3. Search web server logs for POST requests to `/html/socio/sistema/controller/controla_xlsx.php` with suspicious file uploads: `grep -i 'controla_xlsx.php' /var/log/apache2/access.log | grep POST`
4. Examine uploaded files in the WeGIA upload directory for PHP files with Excel magic bytes (PK\x03\x04 or similar): `find /var/www/wegia/uploads -type f -exec file {} \; | grep -i 'php\|executable'`

FAQ

Related PHP CVEs

References

• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-hq96-gvmx-qrwp
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-hq96-gvmx-qrwp