The flaw is a classic SQL injection in WeGIA's DespachoDAO.php, where the id_memorando parameter is extracted from the request without validation and interpolated directly into a SQL query. An authenticated user can supply a malicious value and thereby execute arbitrary SQL commands against the underlying database. This can lead to data theft, alteration or deletion of records, and potentially provide access to sensitive information within the system.

The vulnerability affects LabRedesCefetRJ's WeGIA web manager versions earlier than 3.6.9. The flaw resides in the DespachoDAO.php component of the application.

With a CVSS score of 8.8, the vulnerability is considered high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Attackers only need valid user credentials to operate the web interface and can trigger the injection simply by sending a crafted id_memorando value. No additional privileges or network exposure are required.