The vulnerability occurs when an authenticated user with access to the Material & Patrimônio module submits an id_produto value to the restaurar_produto_desocultar.php script. A second extract() call overwrites the previously sanitized integer, allowing attacker-supplied input to be interpolated directly into UPDATE statements that affect the produto, isaida, and ientrada tables. This flaw, a CWE-89 SQL Injection vulnerability, enables arbitrary SQL execution, which can read sensitive database records or modify inventory data, resulting in confidentiality and integrity compromise.

Affected system: The web manager WeGIA, created by LabRedesCefetRJ. All releases prior to 3.8.6 are vulnerable; upgrade to 3.8.6 or newer eliminates the issue.

The CVSS score of 8.8 indicates a high severity impact. Although the EPSS score is not available, the lack of listing in the CISA KEV catalog suggests no known widespread exploitation yet. Exploitation requires an attacker to authenticate and have permissions to the vulnerable module, thus the attack vector is insider or compromised user. The combination of high severity and a local authenticated prerequisite means the overall risk is moderate to high for environments where privileged users are available.