An authenticated SQL injection flaw in WeGIA, versions prior to 3.6.2, poses a high risk of total database compromise and sensitive data exfiltration.

This is an SQL injection vulnerability (CWE-89) located in the Atendido_ocorrenciaControle endpoint, specifically triggered via the id_memorando parameter. The vulnerability requires the attacker to have authenticated access to the application.

Successful exploitation of this vulnerability allows an authenticated attacker to perform full database exfiltration, potentially exposing sensitive personally identifiable information (PII) of charitable institution members. Depending on server configuration, it may also lead to arbitrary file reads. With a CVSS score of 7.2, this represents a significant risk to data confidentiality and integrity, necessitating prompt remediation to prevent unauthorized access to sensitive records.

Immediate Action: Upgrade to WeGIA version 3.6.2 or later, which contains the official fix for this SQL injection vulnerability.

Proactive Monitoring: Review web server and database access logs for unusual patterns, such as unexpected SQL syntax characters (e.g., apostrophes, comment indicators) within requests to the Atendido_ocorrenciaControle endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the identified parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in GitHub repository Ch35h1r3c47/CVE-2026-23723-POC.

Given the availability of a public proof-of-concept and the high potential for sensitive data exposure, administrators should prioritize updating WeGIA to version 3.6.2 immediately. Organizations unable to patch should verify that access controls are strictly enforced to minimize the risk of unauthorized users gaining the privileges required to trigger this flaw.