WeGIA has Authenticated Time-Based Blind SQL Injection in `restaurar_produto.php` via `id_produto` parameter

The SQL Injection vulnerability in WeGIA allows an authenticated attacker to directly manipulate database queries. By injecting malicious SQL code through the idproduto GET parameter in the /html/matPat/restaurarproduto.php endpoint, an attacker can bypass security controls and execute arbitrary commands. This could result in the unauthorized retrieval, modification, or deletion of sensitive data, including donor information, financial records, and user credentials. Successful exploitation could also lead to privilege escalation and complete control over the WeGIA application and underlying database server. The potential for data exfiltration and disruption is significant.

Charitable institutions and organizations utilizing WeGIA for managing their operations are at significant risk. Specifically, those running older, unpatched versions of WeGIA (3.6.5 and below) are particularly vulnerable. Shared hosting environments where multiple organizations share the same server infrastructure are also at increased risk, as a compromise of one WeGIA instance could potentially lead to the compromise of others.

• linux / server: Monitor web server access logs for requests to /html/matPat/restaurarproduto.php with unusual or suspicious values in the idproduto parameter. Use grep to search for SQL keywords (e.g., SELECT, UNION, DROP) in the request parameters.

grep 'id_produto=.*(SELECT|UNION|DROP).*' /var/log/apache2/access.log

• generic web: Use curl to test the endpoint with various payloads. Check the response for SQL errors or unexpected behavior.

curl 'http://wegia-server/html/matPat/restaurar_produto.php?id_produto=1 UNION SELECT 1,2,3 -- ' 

• database (mysql): If database access is possible, check for unusual database activity or modified tables. Use mysql -e to query the database for suspicious entries.

mysql -u root -p -e "SELECT * FROM users WHERE username LIKE '%evil%';"

1. 2026-03-20Disclosure

   disclosure

1. 予約済み2026-03-17
2. 公開日2026-03-20
3. EPSS 更新日2026-03-27

The primary mitigation for CVE-2026-33134 is to immediately upgrade WeGIA to version 3.6.6 or later, which contains the necessary fix. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to the /html/matPat/restaurarproduto.php endpoint to trusted users only. Web Application Firewalls (WAFs) can be configured to detect and block SQL Injection attempts targeting the idproduto parameter. Thorough input validation and sanitization should be implemented in future development to prevent similar vulnerabilities. After upgrading, confirm the fix by attempting to inject a simple SQL statement through the id_produto parameter and verifying that it is properly sanitized.