CVE-2026-33133: Wegia Web Manager SQLi Vulnerability

CVE-2026-33133 Overview

CVE-2026-33133 is a SQL Injection vulnerability affecting WeGIA, a web manager for charitable institutions. The vulnerability exists in the loadBackupDB() function, which imports SQL files from uploaded backup archives without performing any content validation. This allows an attacker with privileged access to craft a malicious backup archive containing arbitrary SQL statements that can create rogue administrator accounts, modify existing passwords, or execute any database operation.

Critical Impact

Attackers can execute arbitrary SQL statements through malicious backup archives, enabling complete database compromise including creation of unauthorized administrator accounts and modification of user credentials.

Affected Products

• WeGIA version 3.6.5
• WeGIA version 3.6.6

Discovery Timeline

• March 20, 2026 - CVE-2026-33133 published to NVD
• March 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-33133

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) stems from insufficient input validation in the backup restoration functionality. The loadBackupDB() function processes SQL files extracted from user-uploaded backup archives and executes the contained SQL statements directly against the database without sanitization or validation. The vulnerability was introduced in commit 370104c and requires network access with high privileges to exploit. However, once exploited, an attacker gains complete control over database confidentiality, integrity, and availability.

Root Cause

The root cause of this vulnerability is the absence of content validation when processing SQL files from uploaded backup archives. The loadBackupDB() function trusts the contents of the backup archive implicitly and executes any SQL statements contained within the imported files. This violates the fundamental security principle of never trusting user-supplied input, especially when that input is executed directly against critical system components like the database.

Attack Vector

The attack vector is network-based and requires high privileges to execute. An attacker with administrative access to the WeGIA application can exploit this vulnerability by:

1. Creating a crafted backup archive containing malicious SQL statements
2. Uploading the malicious backup through the application's backup restoration interface
3. Triggering the loadBackupDB() function to process the malicious archive
4. The arbitrary SQL statements execute against the database, allowing the attacker to create unauthorized administrator accounts, modify existing user passwords, exfiltrate sensitive data, or perform any other database operation

The vulnerability allows complete database compromise, as the executed SQL statements run with the full privileges of the application's database connection.

Detection Methods for CVE-2026-33133

Indicators of Compromise

• Unexpected administrator accounts appearing in the database that were not created through normal workflows
• Password hash modifications for existing users without corresponding legitimate password change requests
• Database audit logs showing unusual SQL statements executed during backup restoration operations
• Backup restoration activities performed by users who typically do not perform such operations

Detection Strategies

• Monitor and alert on all backup restoration activities, particularly those involving SQL file imports
• Implement database activity monitoring to detect anomalous SQL statements executed during backup operations
• Review application logs for loadBackupDB() function invocations and correlate with user activity patterns
• Enable database auditing to capture all DDL and DML statements for forensic analysis

Monitoring Recommendations

• Configure alerts for new administrator account creation events in the database
• Implement file integrity monitoring on backup archives before restoration
• Monitor for changes to user credentials outside of normal password change workflows
• Establish baseline patterns for backup restoration activities and alert on deviations

How to Mitigate CVE-2026-33133

Immediate Actions Required

• Upgrade WeGIA to version 3.6.7 or later immediately
• Audit existing administrator accounts to identify any unauthorized entries
• Review database audit logs for evidence of exploitation
• Reset passwords for all administrative accounts as a precautionary measure
• Temporarily disable backup restoration functionality if patching cannot be performed immediately

Patch Information

The vulnerability was patched in WeGIA version 3.6.7. The fix was implemented through Pull Request #1459. Organizations should update to the patched version as soon as possible. Additional details are available in the GitHub Security Advisory GHSA-qqff-p8fc-hg5f and the WeGIA v3.6.7 release notes.

Workarounds

• Restrict access to the backup restoration functionality to only trusted administrators with a verified business need
• Implement network-level access controls to limit who can access the backup restoration interface
• Manually validate backup archive contents before restoration by inspecting SQL files for unexpected statements
• Deploy a Web Application Firewall (WAF) with rules to inspect backup upload payloads for malicious SQL patterns