CVE-2024-57031 is a critical severity SQL injection flaw (CVSS 9.8) in WeGIA before 3.2.0. The id_funcionario parameter in the file /funcionario/remuneracao.php is not handled safely. Upgrade to the newest WeGIA release, and keep the application off the open internet until you have.
What's affected
WeGIA is an open source web manager for charitable institutions, developed by the university extension programme at Cefet/RJ in Brazil, according to the project's website. The record says WeGIA before 3.2.0 is vulnerable to SQL injection in /funcionario/remuneracao.php through the id_funcionario parameter. The researcher's write-up in the project's reference list covers it.
No vendor advisory is linked, so there is no confirmed fixed version beyond the range in the record. Versions before 3.2.0 are affected. Release 3.2.0 falls outside that range, but other entries filed on the same date show other flaws still present in 3.2.0, so the newest release is the safer target.
How to check if you're exposed
WeGIA is a PHP web application, so there is no package manager entry to query. Check these instead.
- The version shown in the application, or the release tag or commit you deployed from.
- Whether the install is reachable from the internet. Search your DNS and reverse proxy configuration for the hostname.
- The permissions of the database account the application uses. If it can read every table and write to many, the damage from one injection is wider.
- The web server access log, for requests to the affected file with strange or very long parameter values.
What to do now
- Find every WeGIA installation your organization runs and note its version.
- Move to the newest WeGIA release from the project's GitHub repository. The record says versions before 3.2.0 are affected, but a later entry, CVE-2024-57035, lists 3.2.0 itself, so do not stop at 3.2.0 if a newer release exists.
- If you cannot upgrade now, put the application behind a VPN or an IP allow list.
- Reduce the database account's privileges to the minimum the application needs.
- Review the data held in the system, which can include personal records of staff and beneficiaries, and consider your notification duties under local data protection law if you find signs of misuse.
- Back up the database before any upgrade.
Why it matters
The weakness is CWE-89, SQL injection. A value from the request, here an employee identifier, ends up inside a database query as text instead of being passed as a bound parameter. The database cannot tell the difference between the query the developer wrote and the extra text from the request.
The file name suggests this page deals with employee remuneration, which is sensitive data in any organization. The vector in the record shows network access, low complexity and no privileges, with high impact on all three of confidentiality, integrity and availability. That is the standard profile for an unauthenticated injection. The KEV flag in the record is false. The fix pattern is well known: prepared statements for every query, and an input check on identifiers that expects a number and rejects anything else.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the vulnerable parameter?
The record names id_funcionario in /funcionario/remuneracao.php.
Is 3.2.0 safe?
The record says versions before 3.2.0 are affected. Another CVE filed on the same day lists 3.2.0 as affected, so use the newest release and verify.
Sources
Last reviewed: 19 October 2026.
