CVE-2026-35395: Wegia SQL Injection Vulnerability

CVE-2026-35395 Overview

CVE-2026-35395 is a SQL injection vulnerability discovered in WeGIA, a web-based manager designed for charitable institutions. Prior to version 3.6.9, the application contains a critical SQL injection flaw in the dao/memorando/DespachoDAO.php file. The id_memorando parameter is extracted from $_REQUEST without proper validation and is directly interpolated into SQL queries, enabling any authenticated user to execute arbitrary SQL commands against the database.

Critical Impact

Authenticated attackers can leverage this SQL injection vulnerability to read, modify, or delete sensitive data from the database, potentially compromising the entire charitable institution's records including donor information, financial data, and beneficiary details.

Affected Products

• WeGIA versions prior to 3.6.9
• WeGIA Web Manager for charitable institutions (all configurations using DespachoDAO.php)

Discovery Timeline

• 2026-04-06 - CVE-2026-35395 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-35395

Vulnerability Analysis

This SQL injection vulnerability exists due to improper input validation in the WeGIA application's memorandum dispatch functionality. The vulnerable code resides in dao/memorando/DespachoDAO.php, where user-supplied input from the id_memorando parameter is directly concatenated into SQL query strings without any sanitization or parameterization.

When a request is made to the affected endpoint, the application extracts the id_memorando value from the $_REQUEST superglobal array. This value is then interpolated directly into SQL statements, creating a classic SQL injection attack surface. Since WeGIA is designed for charitable institutions managing sensitive data about donors and beneficiaries, successful exploitation could expose personally identifiable information, financial records, and operational data.

The vulnerability requires authentication to exploit, meaning an attacker must have valid credentials to access the vulnerable endpoint. However, even low-privileged authenticated users can leverage this flaw to escalate their database access beyond their intended permissions.

Root Cause

The root cause of CVE-2026-35395 is the failure to implement proper input validation and parameterized queries in the DespachoDAO.php Data Access Object. The developers directly interpolated user input into SQL query strings instead of using prepared statements with bound parameters. This violates secure coding best practices for database interactions and is a common cause of SQL injection vulnerabilities in PHP applications.

Attack Vector

The attack vector for this vulnerability is network-based. An authenticated attacker can craft malicious HTTP requests containing SQL injection payloads in the id_memorando parameter. These requests are sent to the vulnerable endpoint, where the payload is processed by DespachoDAO.php and executed against the backend database.

The exploitation flow involves sending crafted requests with SQL syntax embedded in the id_memorando parameter. Depending on the database configuration and application behavior, attackers can use techniques such as UNION-based injection, error-based injection, or time-based blind injection to extract data or manipulate database contents. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-35395

Indicators of Compromise

• Unusual SQL error messages in application logs referencing DespachoDAO.php or the memorando module
• HTTP requests to memorando-related endpoints containing SQL syntax characters such as single quotes, semicolons, or SQL keywords like UNION, SELECT, or DROP
• Database query logs showing unexpected or malformed queries originating from the dispatch functionality
• Anomalous database access patterns indicating unauthorized data retrieval or modification

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the id_memorando parameter
• Implement application-level logging to capture all requests to dao/memorando/DespachoDAO.php and related endpoints
• Configure database activity monitoring to alert on unusual query patterns or bulk data access
• Enable SentinelOne's application control features to monitor for suspicious PHP process behavior

Monitoring Recommendations

• Review web server access logs for requests containing SQL injection indicators targeting memorando endpoints
• Monitor database audit logs for queries with unexpected syntax or unauthorized data access
• Set up alerting for failed login attempts followed by successful authentication and immediate access to vulnerable endpoints
• Implement real-time monitoring for error-based SQL injection attempts that may generate distinctive error messages

How to Mitigate CVE-2026-35395

Immediate Actions Required

• Upgrade WeGIA to version 3.6.9 or later immediately, as this version contains the fix for the SQL injection vulnerability
• If immediate patching is not possible, restrict access to the memorando module at the web server or application level
• Review database access logs for signs of prior exploitation and assess potential data exposure
• Implement network-level controls to limit access to the WeGIA application to trusted IP ranges

Patch Information

The vulnerability is fixed in WeGIA version 3.6.9. Organizations running versions prior to 3.6.9 should upgrade immediately. The security patch addresses the SQL injection by implementing proper input validation and parameterized queries for the id_memorando parameter. For additional details, consult the WeGIA GitHub Security Advisory.

Workarounds

• Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection attempts targeting the id_memorando parameter
• Implement input validation at the web server level using ModSecurity or similar tools to reject requests containing SQL syntax
• Restrict access to the vulnerable dao/memorando/DespachoDAO.php endpoint using web server access controls until patching is complete
• Consider temporarily disabling the memorando dispatch functionality if it is not critical to operations

# Example Apache .htaccess configuration to restrict access to vulnerable endpoint
<FilesMatch "DespachoDAO\.php$">
    Require ip 192.168.1.0/24
    # Or deny all external access temporarily
    # Require all denied
</FilesMatch>