WeGIA is a web manager for charitable institutions. The vulnerability is a classic SQL injection in DespachoDAO.php where the id_memorando parameter is extracted from the request without validation and concatenated directly into SQL statements. This flaw allows any authenticated user to execute arbitrary SQL commands, giving the attacker the ability to read, modify, or delete database contents and potentially expose sensitive information or compromise application integrity.

Any installation of WeGIA by LabRedesCefetRJ running a version older than 3.6.9 is affected. The flaw is present in DespachoDAO, which processes memorandum IDs accessed through the web interface. Only authenticated users can reach the vulnerable endpoint; no other versions or components are known to be impacted.

The CVSS score of 8.8 denotes high severity, while the EPSS score of less than 1 % indicates a low near‑term exploitation likelihood and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session and a crafted id_memorando value, enabling the attacker to inject SQL statements that run with the application’s database privileges. This can result in unrestricted database access, data theft, or manipulation of records.