CVE-2026-55680: WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastrocobranca.php can place a quoted SQL expression in the codigo parameter, which extract($REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.8.6
Event History
Frequently Asked Questions
Which deployments are exposed?
WeGIA deployments running a version prior to 3.8.6 are affected if the cadastro_cobranca.php endpoint is reachable by an attacker. The vulnerable request does not require an authenticated session.
What does an attacker need to exploit this issue?
An attacker only needs to send a crafted POST request to web/html/socio/sistema/cadastro_cobranca.php with a quoted SQL expression in the codigo parameter. No privileges or user interaction are required.
What could an attacker do after successful exploitation?
The injection permits arbitrary SQL execution. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table.
What is the available remediation?
Upgrade WeGIA to version 3.8.6, which fixes the issue.