WeGIA is a web manager for charitable institutions. Versions 3.6.5 and below contain an authenticated SQL Injection vulnerability in the html/matPat/restaurar_produto.php endpoint. The vulnerability allows an authenticated attacker to inject arbitrary SQL commands via the id_produto GET parameter, leading to full database compromise. In the script /html/matPat/restaurar_produto.php, the application retrieves the id_produto parameter directly from the $_GET global array and interpolates it directly into two SQL query strings without any sanitization, type-casting (e.g., (int)), or using parameterized (prepare/execute) statements. This issue has been fixed in version 3.6.6.
The script /html/matPat/restaurar_produto.php retrieves the id_produto parameter directly from the $_GET array and inserts its value without any validation or sanitization into two SQL queries. The application does not apply type casting (e.g., to int) or use prepared statements (prepare/execute), allowing an attacker to embed arbitrary SQL instructions in the GET parameter. The exploit requires prior authentication in the application.
An attacker can gain full access to the database — read, modify, or delete its contents. Due to the scope (S:C in the CVSS vector), the impact may extend beyond the direct application context.
WeGIA should be updated to version 3.6.6, where the issue has been fixed. The patch is available in the vendor's repository: https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.6
WeGIA in versions 3.6.5 and lower
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:NWegia
APPWegia< 3.6.6
Related vulnerabilities
Reflected XSS w WeGIA — wstrzyknięcie kodu przez parametr sccd
Reflected XSS w WeGIA — wstrzyknięcie kodu JS przez parametr GET
SQL Injection w WeGIA – nieautoryzowane wykonanie poleceń SQL
WeGIA – pominięcie uwierzytelnienia w adicionar_tipo_docs_atendido.php
WeGIA – RCE przez command injection w funkcji przywracania bazy danych