A critical SQL injection vulnerability in WeGIA versions prior to 3.4.10 poses a severe risk to database confidentiality, integrity, and availability.

This flaw is a SQL injection vulnerability (CWE-89) located in the /html/funcionario/dependente_remover.php endpoint. The vulnerability is triggered by an authenticated attacker manipulating the id_funcionario parameter to execute arbitrary database commands.

Successful exploitation of this vulnerability allows an attacker to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive institutional data or complete loss of system integrity. With a CVSS score of 8.8, this vulnerability represents a high-severity risk that could cause significant operational disruption and compromise the personal information of users managed by the institution.

Immediate Action: Update the WeGIA software to version 3.4.10 or later immediately to incorporate the necessary input sanitization patches.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, particularly those involving the /html/funcionario/dependente_remover.php file or unusual SQL syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the affected application parameter.

Public Exploit Available: Unknown

Given the severity of this vulnerability and the availability of a vendor-provided fix, administrators must prioritize upgrading their WeGIA instances to version 3.4.10. Failure to patch allows authenticated users to potentially compromise the entire database backend, making immediate remediation essential to maintaining the security posture of the institution.