A critical SQL injection vulnerability in WeGIA versions prior to 3.6.9 allows authenticated users to execute arbitrary SQL commands, posing a significant risk to database integrity and confidentiality.

This is a SQL injection vulnerability (CWE-89) located in the dao/memorando/DespachoDAO.php file. The application fails to sanitize the id_memorando parameter, which is taken from the request and directly interpolated into database queries by any authenticated user.

The ability to execute arbitrary SQL commands provides an attacker with complete control over the underlying database. This can lead to unauthorized data exfiltration, modification of sensitive institutional records, and potential system compromise. With a CVSS score of 8.8, this flaw represents a high-severity risk that requires immediate attention to prevent data breach and service disruption.

Immediate Action: Update the WeGIA software to version 3.6.9 or higher to apply the vendor-supplied security patch.

Proactive Monitoring: Review application access logs for unusual SQL syntax or unexpected database query patterns originating from authenticated user sessions.

Compensating Controls: Implement a Web Application Firewall (WAF) configured to detect and block SQL injection patterns to provide a temporary layer of protection while the update is being prepared.

Public Exploit Available: Unknown

Given the high CVSS score and the presence of a known proof-of-concept, administrators should prioritize patching this vulnerability immediately. Upgrading to version 3.6.9 is the only definitive way to remediate the flaw and protect the integrity of the institutional database.