A critical SQL injection vulnerability in the WeGIA web manager for charitable institutions allows authenticated attackers to compromise database integrity and confidentiality.

The application fails to properly sanitize the id_produto parameter within the html/matPat/restaurar_produto.php file. An authenticated user can inject malicious SQL commands, which are then executed directly by the backend database.

Successful exploitation allows an attacker to manipulate, steal, or delete sensitive data stored within the charitable institution database. Given the CVSS score of 8.8, this represents a high risk to data privacy and system integrity, potentially leading to unauthorized access to records and significant operational disruption.

Immediate Action: Update the WeGIA software to version 3.6.6 or later to incorporate the vendor-provided patch.

Proactive Monitoring: Review web access logs for unusual patterns or suspicious characters in the id_produto parameter of requests sent to the restaurar_produto.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection detection rules to inspect and filter malicious payloads directed at the vulnerable endpoint until the update can be applied.

Public Exploit Available: Unknown

The severity of this SQL injection flaw necessitates immediate remediation. Administrators should prioritize upgrading to version 3.6.6 across all instances to prevent unauthorized database access and potential data exfiltration.