WeGIA SQL Injection Vulnerability in Employee Registration Endpoint

A SQL injection vulnerability has been identified in WeGIA versions prior to 3.5.1. The issue is located in the '/html/funcionario/cadastro_funcionario_pessoa_existente.php' endpoint, specifically within the 'cpf' parameter. This vulnerability allows attackers to execute arbitrary SQL commands, potentially leading to unauthorized access and manipulation of database information.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to execute arbitrary SQL commands. This could result in unauthorized access to sensitive data, manipulation of database information, and disruption of database availability.

Reproduction

To reproduce this vulnerability, send a request to the '/html/funcionario/cadastro_funcionario_pessoa_existente.php' endpoint with a crafted 'cpf' payload that includes SQL injection elements. For example, a payload could be used to extract database information, such as the database version.

Remediation

Users are advised to update WeGIA to version 3.5.1 or later, where this vulnerability has been patched.