CVE-2024-57035 is a critical severity SQL injection flaw (CVSS 9.8) in WeGIA v3.2.0. The nextPage parameter in /controle/control.php reaches a database query unsafely. Check the project for a newer release than 3.2.0, and keep the application off the open internet.
What's affected
WeGIA is an open source web manager for charitable institutions, developed by the university extension programme at Cefet/RJ in Brazil, according to the project's website. The record says WeGIA v3.2.0 is vulnerable to SQL injection via the nextPage parameter in /controle/control.php. That is the first version outside the range of the other WeGIA entries filed on the same date, which is why you should not treat 3.2.0 as clean.
The reference list contains the researcher's write-up and an issue in the project's GitHub tracker, number 827. We could load the write-up, but the tracker page was not available when we checked. There is no vendor advisory, so the fixed version is not confirmed. Look at the project's releases page and release notes for anything newer than 3.2.0.
How to check if you're exposed
WeGIA is a PHP web application, so there is no package manager entry to query. Check these instead.
- The version shown in the application, or the release tag or commit you deployed from.
- Whether the install is reachable from the internet. Search your DNS and reverse proxy configuration for the hostname.
- The permissions of the database account the application uses. If it can read every table and write to many, the damage from one injection is wider.
- The web server access log, for requests to the affected file with strange or very long parameter values.
What to do now
- Find every WeGIA installation and note the version. Treat 3.2.0 as affected for this CVE.
- Look at the project's GitHub releases and issue tracker for a release newer than 3.2.0 and any notes on this issue, and move to it.
- Until you can upgrade, limit access with a VPN or IP allow list.
- Reduce the database account's privileges to the minimum.
- Review web server logs for odd requests to control.php with unusual nextPage values.
- Plan a code review of how the application builds queries, since several pages are affected.
Why it matters
The weakness is CWE-89, SQL injection. A paging parameter such as nextPage looks harmless. Developers often treat it as a number or a page name, so it gets less care than a login field. But if the value reaches a query as text, it is as dangerous as any other input.
The vector in the record shows network access with no privileges and high impact, so 9.8. It also shows how a version number can mislead. Other entries say the problem is in versions before 3.2.0, and this one says 3.2.0 itself. Always read the record for the exact version in question. The KEV flag in the record is false. For anything that turns up in several places, use a scanner against a test copy and fix the root cause in the shared data access code.
Quick check
Is WeGIA 3.2.0 affected?
This record names v3.2.0 itself. Other WeGIA entries name versions before 3.2.0. Use the newest release available.
Why do paging parameters get missed?
They look like harmless numbers or names, so they are often left out of validation. Treat every request value as untrusted.
Sources
Last reviewed: 19 October 2026.
