WeGIA is a web manager for charitable institutions. Prior to version 3.6.6, a critical SQL injection vulnerability exists in the WeGIA application. The remover_…

A critical SQL injection vulnerability exists in WeGIA web manager for charitable institutions prior to version 3.6.6. The vulnerability occurs in the remover_produto_ocultar.php script which uses extract($_REQUEST) to populate local variables and directly concatenates them into SQL queries executed via PDO::query. This allows authenticated or auth-bypassed attackers to execute arbitrary SQL commands, potentially leading to data exfiltration or denial of service through time-based delays. The vulnerability has been fixed in version 3.6.6.