WeGIA SQL Injection Vulnerability in verificar_recursos_cargo.php Endpoint

A SQL injection vulnerability has been identified in the WeGIA web application for charitable institutions. The issue is present in versions prior to 3.2.7, specifically within the '/dao/verificar_recursos_cargo.php' endpoint and the 'cargo' parameter. This vulnerability allows attackers to execute arbitrary SQL commands, potentially leading to unauthorized access, data manipulation, and disruption of application services. The root cause is inadequate validation and sanitization of user inputs, which enables the injection of malicious SQL payloads that are executed by the database.

Impact

Exploitation of this vulnerability allows for blind, time-based SQL injection, where an attacker can execute arbitrary SQL commands and introduce delays in the server response, indicating successful exploitation. Such actions could be used to exfiltrate data, manipulate database information, disrupt application functionality, and compromise user credentials.

Reproduction

To reproduce this vulnerability, send a request to the '/dao/verificar_recursos_cargo.php' endpoint with a crafted payload in the 'cargo' parameter that includes SQL injection techniques, such as time-based delays. The server's response time will increase, demonstrating the execution of the injected SQL command.

Remediation

Users can update to WeGIA version 3.2.8 to address this vulnerability.