LabRedesCefetRJ WeGIA versions 3.6.5 and 3.6.6 are vulnerable to SQL injection, which allows authenticated administrators to execute arbitrary database commands and potentially compromise the entire system.

The loadBackupDB function fails to perform content validation when importing SQL files from uploaded backup archives. This allows an authenticated administrator to inject malicious SQL statements to create rogue accounts, alter passwords, or perform unauthorized database operations.

Successful exploitation of this vulnerability permits full control over the application database. This could lead to a total loss of confidentiality, integrity, and availability of institutional data. Given the CVSS score of 7.2, the risk is significant, as it provides an attacker with the ability to manipulate administrative functions and compromise the underlying data infrastructure.

Immediate Action: Update the WeGIA installation to version 3.6.7 or later to implement the necessary input validation for backup imports.

Proactive Monitoring: Review database access logs for unexpected administrative account creation or unusual SQL commands originating from the backup restoration process.

Compensating Controls: Restrict access to the backup and restore functionality to trusted personnel only and monitor file upload directories for unauthorized or suspicious backup archives.

Public Exploit Available: Unknown

The risk posed by this SQL injection vulnerability necessitates immediate attention. Administrators must prioritize updating to version 3.6.7 to close the attack vector. Failure to patch allows any user with administrative privileges to gain full control over the database, leading to potential long-term data compromise.