SQL Injection on Natan Maia Morette

CVE-2026-12188: grit42 — SQL Injection in CSV Export Endpoint

Sun, 14 Jun 2026 00:00:00 -0300

⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the Thoropass Vulnerability Research Program. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-12188%20-%20grit42%20-%20SQL%20Injection%20in%20CSV%20Export%20Endpoint
📋 CVE record: CVE-2026-12188

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	grit - Open-source scientific research data management platform built by grit42 A/S. The platform stores and visualises data from pre-clinical drug discovery workflows: compounds, batches, assay models, experiment results, and dynamically-typed data tables.
Affected Version	0.0.x through 0.11.0 (every public release; sink introduced in initial commit `79b9dfa`)
Endpoint	`GET /api/grit/<engine>/<resource>/export` (any resource declared with `resources_with_export`)
Vulnerability Type	CWE-89: SQL Injection
CVE ID	CVE-2026-12188

Vulnerability Summary

The CSV export action in grit’s GritEntityController splats the user-controlled params[:columns] into Model.unscoped.select(*params[:columns]), then wraps the resulting relation in a PostgreSQL COPY (...) TO STDOUT WITH CSV HEADER statement. Rails’ select accepts raw SQL fragments, so any authenticated user can inject sub-selects into the SELECT clause and exfiltrate any column the database role can see.

CVE-2025-53527: SQL Injection Vulnerability in tipo and responsavel Parameters on relatorio_geracao.php Endpoint

Mon, 07 Jul 2025 00:00:00 -0300

⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the CVE Hunters. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-53527/
📋 CVE record: CVE-2025-53527

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-53527

Summary

A SQL Injection vulnerability was identified in the tipo and responsavel parameters of the /controle/relatorio_geracao.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data.

CVE-2025-53091: Unauthenticated Time-Based SQL Injection Vulnerability in almox Parameter

Fri, 27 Jun 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-53091/
📋 CVE record: CVE-2025-53091

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-53091

Summary

A Time-Based Blind SQL Injection vulnerability was discovered in the almox parameter of the /controle/getProdutosPorAlmox.php endpoint. This issue allows any unauthenticated attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration.

CVE-2025-52474: SQL Injection Vulnerability in id Parameter on control.php Endpoint

Thu, 19 Jun 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-52474/
📋 CVE record: CVE-2025-52474

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-52474

Summary

A SQL Injection vulnerability was identified in the id parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data.

CVE-2025-30367: SQL Injection endpoint control.php parameter nextPage

Thu, 27 Mar 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-30367/
📋 CVE record: CVE-2025-30367

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-30367

Summary

A SQL Injection vulnerability was identified in the WeGIA application, specifically in the control.php endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in the database, allowing unauthorized access to sensitive information. During the exploit, it was possible to perform a complete dump of the application's database, highlighting the severity of the flaw.

CVE-2024-57031: SQL Injection (Blind Time-Based) in remuneracao.php parameter id_funcionario

Fri, 17 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-57031/
📋 CVE record: CVE-2024-57031

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-57031

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2024-57034: SQL Injection in query_geracao_auto.php

Fri, 17 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-57034/
📋 CVE record: CVE-2024-57034

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-57034

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2024-57035: SQL Injection Vulnerability in nextPage Parameter on control.php Endpoint

Fri, 17 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-57035/
📋 CVE record: CVE-2024-57035

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-57035

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544