A critical SQL injection vulnerability in WeGIA allows authenticated users to impersonate others and execute arbitrary database queries, posing a significant risk to data integrity and confidentiality.

The application utilizes an insecure extract($_REQUEST) call within DespachoControle::verificarDespacho(), which permits the overwriting of session-stored user identity. This attacker-controlled value is subsequently interpolated into raw SQL queries in dao/memorando/UsuarioDAO.php, enabling any authenticated user to perform unauthorized database operations.

Successful exploitation of this flaw allows an attacker to bypass intended access controls and execute arbitrary SQL commands against the underlying database. Given the CVSS score of 8.8, this vulnerability carries a high potential for unauthorized data exfiltration, manipulation of institutional records, and total compromise of the application data layer.

Immediate Action: Upgrade WeGIA to version 3.6.10 or later, which incorporates the necessary input sanitization and logic fixes to prevent request parameter injection.

Proactive Monitoring: Review application access logs for unusual patterns in the cpf_usuario parameter and monitor database audit logs for unauthorized or unexpected queries originating from authenticated users.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads and suspicious request parameter modifications.

Public Exploit Available: Unknown

Due to the severity of this vulnerability and the potential for complete database compromise, organizations using WeGIA must prioritize the update to version 3.6.10. Administrators should verify the patch deployment immediately and conduct a review of database logs for any indicators of compromise occurring prior to the update.