Skip to content
Threat Feed
high advisory

WeGIA Web Manager SQL Injection Vulnerability (CVE-2026-33991)

WeGIA web manager prior to version 3.6.7 is vulnerable to SQL injection via the `id_tag` parameter in the `deletar_tag.php` script due to unsanitized input and direct concatenation into SQL queries, potentially allowing attackers to read, modify, or delete data.

WeGIA, a web manager for charitable institutions, is susceptible to SQL injection in versions prior to 3.6.7. The vulnerability resides in the html/socio/sistema/deletar_tag.php file, where the application uses extract($_REQUEST) on line 14 and directly concatenates the $id_tag variable into SQL queries on lines 16-17. This occurs without proper sanitization or the use of prepared statements. The lack of input validation allows attackers to inject arbitrary SQL commands, potentially…

Detection coverage 2

Detect WeGIA SQL Injection Attempt

high

Detects potential SQL injection attempts targeting the WeGIA application by looking for suspicious keywords in HTTP request URIs.

sigma tactics: initial_access techniques: T1190 sources: webserver, linux

Detect WeGIA SQL Injection via Extract Function Abuse

medium

Detects SQL injection attempts in WeGIA by identifying requests to the vulnerable deletar_tag.php script that also contain common SQL injection payloads within request parameters.

sigma tactics: initial_access techniques: T1190 sources: webserver, linux

Detection queries are kept inside the platform. Get full rules →