CVE-2026-33134
Wstrzyknięcie SQL w WeGIA umożliwia uwierzytelnionemu atakującemu pełne przejęcie bazy danych poprzez manipulację parametrem id_produto.
WeGIA is a web manager for charitable institutions. Versions 3.6.5 and below contain an authenticated SQL Injection vulnerability in the html/matPat/restaurar_produto.php endpoint. The vulnerability allows an authenticated attacker to inject arbitrary SQL commands via the id_produto GET parameter, leading to full database compromise. In the script /html/matPat/restaurar_produto.php, the application retrieves the id_produto parameter directly from the $_GET global array and interpolates it directly into two SQL query strings without any sanitization, type-casting (e.g., (int)), or using parameterized (prepare/execute) statements. This issue has been fixed in version 3.6.6.
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 9.3 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.0% |
| Opublikowano (NVD) | 2026-03-20 11:18:03 UTC |
| Ostatnia modyfikacja (NVD) | 2026-03-20 19:26:28 UTC |
- https://github.com/LabRedesCefetRJ/WeGIA/pull/1457 (security-advisories@github.com) [Issue Tracking, Patch]
- https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.6 (security-advisories@github.com) [Product, Release Notes]
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qg95-x997-66wq (security-advisories@github.com) [Exploit, Vendor Advisory]