CVE-2026-33134: WeGIA has Authenticated Time-Based Blind SQL Injection in `restaurar_produto.php` via `id_produto` parameter
WeGIA is a web manager for charitable institutions. Versions 3.6.5 and below contain an authenticated SQL Injection vulnerability in the html/matPat/restaurarproduto.php endpoint. The vulnerability allows an authenticated attacker to inject arbitrary SQL commands via the idproduto GET parameter, leading to full database compromise. In the script /html/matPat/restaurarproduto.php, the application retrieves the idproduto parameter directly from the $GET global array and interpolates it directly into two SQL query strings without any sanitization, type-casting (e.g., (int)), or using parameterized (prepare/execute) statements. This issue has been fixed in version 3.6.6.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33134?
CVE-2026-33134 is classified as a high severity vulnerability due to its potential for data exposure and exploitation through SQL injection.
How do I fix CVE-2026-33134?
To fix CVE-2026-33134, update WeGIA to version 3.6.6 or later which contains the necessary patches.
What types of attacks can exploit CVE-2026-33134?
CVE-2026-33134 can be exploited through authenticated time-based blind SQL injection attacks by manipulating the id_produto parameter.
Which versions of WeGIA are affected by CVE-2026-33134?
Versions of WeGIA up to and including 3.6.5 are affected by CVE-2026-33134.
Is authentication required to exploit CVE-2026-33134?
Yes, CVE-2026-33134 requires authentication to exploit the SQL injection vulnerability.