Attack Chain

1. An authenticated user logs into the WeGIA web application.
2. The user navigates to a page that triggers the execution of dao/memorando/DespachoDAO.php.
3. The application extracts the id_memorando parameter from the $_REQUEST array using the HTTP GET or POST method.
4. The attacker crafts a malicious id_memorando parameter containing SQL injection payloads (e.g., 1; DROP TABLE users; --).
5. The application directly interpolates the attacker-controlled id_memorando parameter into an SQL query without proper sanitization within the DespachoDAO.php file.
6. The database server executes the injected SQL command, allowing the attacker to manipulate database records, read sensitive data, or execute arbitrary commands.
7. The attacker may exfiltrate sensitive data from the database, such as user credentials, financial information, or confidential memorandums.
8. The attacker achieves complete database compromise, potentially leading to a full system takeover.

Impact

The SQL injection vulnerability in WeGIA versions prior to 3.6.9 poses a significant risk to charitable institutions using the software. Successful exploitation can lead to unauthorized access to sensitive donor information, financial records, and confidential communications. The potential impact includes data breaches, financial losses, reputational damage, and legal liabilities. Given the nature of the targeted institutions, this vulnerability could severely disrupt their operations and erode public trust, potentially affecting thousands of individuals. Organizations that do not apply the patch are vulnerable to data breaches.

Recommendation

• Immediately upgrade WeGIA to version 3.6.9 to remediate the SQL injection vulnerability described in CVE-2026-35395.
• Implement input validation and sanitization for all user-supplied data, especially the id_memorando parameter in DespachoDAO.php, to prevent future SQL injection attacks.
• Deploy the Sigma rule “Detect Suspicious WeGIA SQL Injection Attempts” to your SIEM and tune it for your environment to detect exploitation attempts.
• Monitor web server logs for suspicious requests containing SQL injection payloads targeting the dao/memorando/DespachoDAO.php endpoint.
• Restrict database access privileges to the minimum required for WeGIA to function correctly.