CVE-2026-40285: WeGIA has SQL Injection via Session Variable Override in DespachoControle.php
WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in dao/memorando/UsuarioDAO.php. The cpfusuario POST parameter overwrites the session-stored user identity via extract($REQUEST) in DespachoControle::verificarDespacho(), and the attacker-controlled value is then interpolated directly into a raw SQL query, allowing any authenticated user to query the database under an arbitrary identity. Version 3.6.10 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40285?
The severity of CVE-2026-40285 is high due to its potential for SQL injection attacks.
How do I fix CVE-2026-40285?
To fix CVE-2026-40285, upgrade WeGIA to version 3.6.10 or later.
What versions of WeGIA are affected by CVE-2026-40285?
WeGIA versions prior to 3.6.10 are affected by CVE-2026-40285.
What type of vulnerability is CVE-2026-40285?
CVE-2026-40285 is an SQL injection vulnerability that allows attackers to manipulate database queries.
What is the impact of CVE-2026-40285 on WeGIA users?
The impact of CVE-2026-40285 includes unauthorized access to sensitive data due to compromised user identities.