CVE-2024-57034: Critical SQL Injection in WeGIA query_geracao_auto.php

CVE-2024-57034 is a critical severity SQL injection flaw (CVSS 9.8) in WeGIA before 3.2.0. The query parameter of query_geracao_auto.php is passed into a database query unsafely. Upgrade to the newest WeGIA release, and keep the application off the open internet until then.

What's affected

WeGIA is an open source web manager for charitable institutions, developed by the university extension programme at Cefet/RJ in Brazil, according to the project's website. The record says WeGIA before 3.2.0 is vulnerable to SQL injection in query_geracao_auto.php through the query parameter. The reference list holds the researcher's write-up and the project site.

This is one of several WeGIA entries filed together. CVE-2024-57031 and CVE-2024-57035 are SQL injection in other pages, and CVE-2024-57032 is a password change flaw. Fixing one does not help with the others unless you move to a release that includes all the fixes. There is no vendor advisory, so no confirmed fixed version beyond the range in the record.

How to check if you're exposed

WeGIA is a PHP web application, so there is no package manager entry to query. Check these instead.

• The version shown in the application, or the release tag or commit you deployed from.
• Whether the install is reachable from the internet. Search your DNS and reverse proxy configuration for the hostname.
• The permissions of the database account the application uses. If it can read every table and write to many, the damage from one injection is wider.
• The web server access log, for requests to the affected file with strange or very long parameter values.

What to do now

1. Find every WeGIA installation your organization runs and note its version.
2. Move to the newest WeGIA release from the project's GitHub repository. The record says versions before 3.2.0 are affected, but a later entry, CVE-2024-57035, lists 3.2.0 itself, so do not stop at 3.2.0 if a newer release exists.
3. If you cannot upgrade now, put the application behind a VPN or an IP allow list.
4. Reduce the database account's privileges to the minimum the application needs.
5. Review the data held in the system, which can include personal records of staff and beneficiaries, and consider your notification duties under local data protection law if you find signs of misuse.
6. Back up the database before any upgrade.

Why it matters

The weakness is CWE-89, SQL injection. The parameter here is called query, and the file name suggests a feature that generates something automatically from a query. When the parameter itself carries query text, the risk is even sharper than the usual case of a value dropped into a statement. The application hands the caller's text to the database, and nothing separates data from instructions.

The vector in the record shows network access, no privileges and high impact across confidentiality, integrity and availability, which gives 9.8. The KEV flag is false. Several injection points in one application usually mean a pattern, not a slip. A review of every place the code builds a query from request values pays off more than patching each report as it arrives. Static analysis and a web scan against a test copy are cheap ways to find the rest.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Researcher write-up for CVE-2024-57034
• WeGIA project site

Last reviewed: 19 October 2026.