WeGIA, a web manager for charitable institutions, contains a SQL injection flaw in the dao/memorando/UsuarioDAO.php layer. The vulnerability arises because the cpf_usuario POST parameter overwrites the session stored user identity via extract($_REQUEST) in DespachoControle::verificarDespacho(). The attacker-controlled value is then concatenated directly into a raw SQL query, allowing an authenticated user to query the database as any arbitrary user. This elevates privileges and can expose sensitive data, a classic injection weakness identified by CWE‑89.

LabRedesCefetRJ’s WeGIA installations running any version prior to 3.6.10 are susceptible. The fix was applied in version 3.6.10, which strictly validates the user identifier and uses secure query construction.

The vulnerability scores a CVSS of 8.8, indicating high severity. No EPSS data is available and the issue is not listed in the CISA KEV catalog, but the lack of authentication or network restrictions in the description means that any logged‑in user on a compromised or trusted network can exploit the flaw. Exploitation requires only a valid session and the ability to send a crafted POST request with a cpf_usuario payload.