Database compromise via unsanitized cargo parameter

SQL injection in WeGIA before 3.4.5 allows remote attackers to execute arbitrary database commands through the cargo parameter. The /controle/control.php endpoint passes cargo input into a database query without validation or sanitization, so a crafted SLEEP expression executes as SQL and produces a measurable response delay. The endpoint is publicly reachable without authentication, and successful injection permits database reads or writes and can interrupt database-backed service.