The vulnerability exists in WeGIA versions before 3.6.7 in the file html/socio/sistema/deletar_tag.php. On line 14, the code uses extract($_REQUEST), which imports user-supplied parameters into the local symbol table. Subsequently, the $id_tag variable is concatenated directly into SQL queries on lines 16-17 without any input sanitization or use of prepared statements, leading to improper neutralization of special elements in SQL commands (CWE-89). This flaw enables SQL injection attacks. The issue is resolved in version 3.6.7 by presumably fixing the input handling and query construction.

Successful exploitation can lead to complete compromise of the database's confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). An attacker with low privileges can execute arbitrary SQL commands, potentially extracting sensitive data, modifying or deleting data, or disrupting service.

Upgrade WeGIA to version 3.6.7 or later, where this vulnerability is patched. Since the vendor has released an official fix, applying this update is the recommended remediation. No additional mitigation steps are indicated by the vendor advisory.