CVE-2026-54767: WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletarsocios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only against a hardcoded chavecorreta value embedded in the public source repository. A remote attacker who obtains that value can reach the endpoint's TRUNCATE TABLE operations for the endereco, pessoafisica, pessoajuridica, and socio tables without an administrative session or application authorization, permanently destroying member and contributor records. The attack requires the affected tables to exist and the web process database account to possess truncation privileges. This issue is fixed in version 3.8.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIA (weGIA)to a version that resolves this vulnerability.Fixed in 3.8.5 - Compensating control
Ensure the web process database account does not have TRUNCATE TABLE privileges for the endereco, pessoafisica, pessoajuridica, and socio tables (the attack requires truncation privileges on these tables).
- Compensating control
If feasible, remove direct external access to the unauthenticated endpoint deletar_socios.php (web/html/socio/sistema/controller/deletar_socios.php) so attackers cannot invoke the TRUNCATE TABLE functionality via GET without an administrative session or application authorization.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker who can obtain the hardcoded chave_correta value can invoke the unauthenticated GET endpoint. No administrative session or other application authorization is required.
What conditions must exist for the destructive operation to succeed?
The endereco, pessoafisica, pessoajuridica, and socio tables must exist, and the web process database account must have permission to truncate them. If successful, the affected member and contributor records are permanently destroyed.
Are default or publicly exposed deployments at particular risk?
Deployments are at risk if they run a version prior to 3.8.5 and expose the affected endpoint, because the required secret value is embedded in the public source repository. The endpoint is reachable through an unauthenticated GET request.
What should be done if patching cannot happen immediately?
Restrict access to the affected endpoint and remove truncation privileges from the web process database account where operationally possible. These steps can prevent the endpoint from performing the destructive database operations until version 3.8.5 can be deployed.