PT-2026-26605 · Labredescefetrj+1 · Wegia

Bao190505 · Published 2026-03-20 · Updated 2026-03-20 · CVE-2026-33134

Mitre

CVSS v3.1

9.3

Critical

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

WeGIA is a web manager for charitable institutions. Versions 3.6.5 and below contain an authenticated SQL Injection vulnerability in the html/matPat/restaurar produto.php endpoint. The vulnerability allows an authenticated attacker to inject arbitrary SQL commands via the id produto GET parameter, leading to full database compromise. In the script /html/matPat/restaurar produto.php, the application retrieves the id produto parameter directly from the $ GET global array and interpolates it directly into two SQL query strings without any sanitization, type-casting (e.g., (int)), or using parameterized (prepare/execute) statements. This issue has been fixed in version 3.6.6.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-33134

Affected Products

Wegia

References · 7

• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qg95-x997-66wq · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/pull/1457 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33134 · Security Note
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.6 · Note
• https://twitter.com/CveFindCom/status/2034958849963143319 · Twitter Post
• https://twitter.com/cyberbivash/status/2034977954900427163 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034964442576818637 · Twitter Post