An authenticated attacker can inject arbitrary SQL commands through the id_produto GET parameter in the restaurar_produto.php endpoint. The code concatenates the parameter directly into two SQL statements without input validation or parameterization, enabling full data extraction, modification, or deletion across the database. This weakness falls under CWE‑89 and, if exploited, can lead to complete compromise of sensitive institutional data and alteration of critical business records.

The affected system is the WeGIA web manager for charitable institutions developed by LabRedesCefetRJ. Versions 3.6.5 and earlier contain the vulnerability. The issue was fixed in release 3.6.6. All deployments running 3.6.5 or lower are vulnerable until upgraded.

The vulnerability scores 9.3 on CVSS, indicating a critical severity. EPSS is below 1 %, suggesting a low probability of widespread exploitation, and it is not listed in the CISA KEV catalog. The attack requires an authenticated session, meaning an attacker must already have valid credentials. The exploitation path involves sending a crafted id_produto value and observing timing responses to confirm the injection, enabling the attacker to extract or modify database contents.