The vulnerability exists in WeGIA versions before 3.8.5 in the web/html/socio/sistema/controller/deletar_socios.php file. An unauthenticated GET endpoint accepts a 'chave' parameter which is validated only against a hardcoded 'chave_correta' value embedded in the public source repository. An attacker who discovers this key can invoke TRUNCATE TABLE commands on the endereco, pessoafisica, pessoajuridica, and socio tables. This allows permanent deletion of critical data without requiring an administrative session or any application authorization. The exploit requires the affected database tables to exist and the web process database account to have truncation privileges. The vulnerability is addressed in version 3.8.5.

Successful exploitation results in permanent destruction of member and contributor records by truncating critical database tables. This leads to a complete loss of data integrity and availability for these tables, severely impacting the affected charitable institutions' operations. The vulnerability does not affect confidentiality but causes high integrity and availability impact.

Upgrade to WeGIA version 3.8.5 or later, where this vulnerability is fixed. The fix removes the unauthenticated access to the destructive endpoint and eliminates reliance on a hardcoded key. Until upgrade, restrict access to the affected endpoint and database permissions if possible to mitigate risk.