A critical SQL injection vulnerability in WeGIA versions prior to 3.4.5 allows unauthenticated remote attackers to compromise the confidentiality, integrity, and availability of the database.

This is a SQL injection flaw (CWE-89) located in the id_socio parameter of the /WeGIA/html/socio/sistema/processa_deletar_socio.php file. The vulnerability is exploitable by unauthenticated attackers with no required user interaction.

The ability to execute arbitrary SQL commands poses a severe risk to organizational operations, potentially leading to unauthorized data exfiltration, modification of sensitive records, or total system compromise. Given the CVSS score of 8.8, this vulnerability is classified as High severity, necessitating immediate remediation to prevent potential data breaches or service disruption.

Immediate Action: Upgrade to WeGIA version 3.4.5 or later, which contains the official security patch for this vulnerability.

Proactive Monitoring: Review web access logs for unusual patterns or suspicious characters in URL parameters targeting the processa_deletar_socio.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing SQL syntax patterns targeting the identified vulnerable parameter until the software update can be applied.

Public Exploit Available: No (exploit_available unknown)

Due to the ease of exploitation and the significant risk of database compromise, organizations utilizing WeGIA must prioritize upgrading to version 3.4.5 immediately. Failure to patch this vulnerability leaves the underlying data infrastructure exposed to potential remote attackers who can leverage the SQL injection flaw to gain unauthorized access or manipulate stored information.