A critical SQL injection vulnerability in WeGIA versions prior to 3.6.7 allows authenticated attackers to manipulate backend database queries, posing a severe risk to data integrity and confidentiality.

The application suffers from an SQL injection flaw in the file html/socio/sistema/deletar_tag.php, where the use of extract($_REQUEST) combined with unsanitized concatenation of the id_tag variable into SQL queries allows an authenticated user to perform unauthorized database operations.

The exploitation of this vulnerability could lead to the complete compromise of the underlying database, including unauthorized data extraction, modification, or deletion. Given the CVSS score of 8.8, this flaw represents a high risk to the confidentiality, integrity, and availability of sensitive charitable institution records, potentially resulting in significant reputational damage and operational disruption.

Immediate Action: Update the WeGIA software installation to version 3.6.7 or later, which includes the necessary patch to remediate the SQL injection vulnerability.

Proactive Monitoring: Audit database access logs for unusual query patterns or unexpected commands originating from the deletar_tag.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting HTTP request parameters.

Public Exploit Available: Unknown.

Organizations utilizing WeGIA must prioritize the upgrade to version 3.6.7 immediately to eliminate this injection vector. Failure to patch leaves the backend database exposed to unauthorized manipulation by any authenticated user, which could result in a total loss of data control.