CVE-2026-55681: WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit idproduto to web/html/matPat/restaurarprodutodesocultar.php, where a second extract($REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables. An attacker can execute arbitrary SQL to extract sensitive database records or modify institutional and inventory data. This issue is fixed in version 3.8.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.8.6
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user needs access to the Material & Patrimônio module. No user interaction is required beyond the attacker submitting a crafted id_produto parameter to the affected endpoint.
Which deployments are affected?
WeGIA versions prior to 3.8.6 are affected. The vulnerable endpoint is web/html/matPat/restaurar_produto_desocultar.php.
What can an attacker do through this vulnerability?
The attacker can execute arbitrary SQL through the id_produto parameter. This can expose sensitive database records and allow modification of institutional and inventory data in the produto, isaida, and ientrada tables.
What should be done if upgrading cannot happen immediately?
Restrict access to the Material & Patrimônio module to only trusted authenticated users, since module access is required for exploitation. Monitor use of the affected endpoint and review relevant database records for unauthorized changes.